

Getting started with Services APIs

Installing CRDs

This project provides a collection of Custom Resource Definitions (CRDs) that can be installed into any Kubernetes (>= 1.16) cluster.

To install the CRDs, please execute:

kubectl kustomize "github.com/external-secrets/external-secrets/config/crd" \
| kubectl apply -f -

Install the controller

kubectl kustomize "github.com/external-secrets/external-secrets/config/default" \
| kubectl apply -f -

Create your first SecretStore

apiVersion: external-secrets.io/v1alpha1
kind: SecretStore
metadata:
  name: secretstore-sample
spec:
  controller: dev
  provider:
    aws:
      service: SecretsManager
      role: arn:aws:iam::123456789012:role/team-a-reader
      region: us-east-1
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: awssm-secret
            key: access-key
          secretAccessKeySecretRef:
            name: awssm-secret
            key: secret-access-key

Create your first ExternalSecret

apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: example
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: secretstore-sample
    kind: SecretStore
  target:
    name: secret-to-be-created
    creationPolicy: Owner
  data:
  - secretKey: secret-key-to-be-managed
    remoteRef:
      key: provider-key
      version: provider-key-version
      property: provider-key-property
  dataFrom:
  - remoteRef:
    key: remote-key-in-the-provider

kubectl describe externalsecret example
# [...]
Name:  example
Status:
  Conditions:
    Last Transition Time:  2021-02-24T16:45:23Z
    Message:               Secret was synced
    Reason:                SecretSynced
    Status:                True
    Type:                  Ready
  Refresh Time:            2021-02-24T16:45:24Z
Events:                    <none>

For more advanced examples, please read the other guides.

Uninstalling the CRDs

To uninstall the CRDs and all resources created with them, run the following command. Note that this will remove all ExternalSecrets and SecretStore resources in your cluster. If you have been using these resources for any other purpose do not uninstall these CRDs.

kubectl kustomize "github.com/external-secrets/external-secrets/config/crd" \
| kubectl delete -f -