The External Secrets Operator manages the lifecycle of secrets in Kubernetes. With
deletionPolicy you get fine-grained control of its lifecycle.
Creation/Deletion Policy Combinations
Some combinations of creationPolicy/deletionPolicy are not allowed as they would delete existing secrets:
spec.target.creationPolicy defines how the operator creates the a secret.
The External Secret Operator creates secret and sets the
ownerReference field on the Secret. This secret is subject to garbage collection if the initial
ExternalSecret is absent. If a secret with the same name already exists that is not owned by the controller it will result in a conflict. The operator will just error out, not claiming the ownership.
The operator creates the secret but does not set the
ownerReference on the Secret. That means the Secret will not be subject to garbage collection. If a secret with the same name already exists it will be updated.
The operator does not create a secret. Instead, it expects the secret to already exist. Values from the secret provider will be merged into the existing secret. Note: the controller takes ownership of a field even if it is owned by a different entity. Multiple ExternalSecrets can use
creationPolicy=Merge with a single secret as long as the fields don't collide - otherwise you end up in an oscillating state.
The operator does not create or update the secret, this is basically a no-op.
DeletionPolicy defines what should happen if a given secret gets deleted from the provider.
DeletionPolicy is only supported on the following providers. Please feel free to contribute more: * AWS Secrets Manager * AWS Parameter Store
Retain will retain the secret if all provider secrets have been deleted. If a provider secret does not exist the ExternalSecret gets into the SecretSyncedError status.
Delete deletes the secret if all provider secrets are deleted. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status. This is also true for new ExternalSecrets mapping to non-existing secrets in the provider.
Merge removes keys in the secret, but not the secret itself. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status.