|
|
@@ -3455,6 +3455,8 @@
|
|
|
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
|
|
|
<label class="md-nav__link md-nav__link--active" for="__toc">
|
|
|
|
|
|
@@ -3497,6 +3499,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
|
|
|
<label class="md-nav__title" for="__toc">
|
|
|
<span class="md-nav__icon md-icon"></span>
|
|
|
@@ -3505,18 +3509,6 @@
|
|
|
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="#github" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- GitHub
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
- <nav class="md-nav" aria-label="GitHub">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
<a href="#limitations" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -3526,8 +3518,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#configuring-github-provider" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -3537,8 +3529,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#configuring-the-secret-store" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -3548,8 +3540,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#pushing-to-an-external-secret" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -3558,11 +3550,6 @@
|
|
|
</span>
|
|
|
</a>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
-
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
@@ -5028,6 +5015,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
|
|
|
<label class="md-nav__title" for="__toc">
|
|
|
<span class="md-nav__icon md-icon"></span>
|
|
|
@@ -5036,18 +5025,6 @@
|
|
|
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="#github" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- GitHub
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
- <nav class="md-nav" aria-label="GitHub">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
<a href="#limitations" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -5057,8 +5034,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#configuring-github-provider" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -5068,8 +5045,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#configuring-the-secret-store" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -5079,8 +5056,8 @@
|
|
|
</a>
|
|
|
|
|
|
</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
<a href="#pushing-to-an-external-secret" class="md-nav__link">
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
@@ -5089,11 +5066,6 @@
|
|
|
</span>
|
|
|
</a>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
-
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
@@ -5116,18 +5088,17 @@
|
|
|
|
|
|
|
|
|
|
|
|
- <h1>Github Actions Secrets</h1>
|
|
|
-
|
|
|
-<h2 id="github">GitHub</h2>
|
|
|
+<h1 id="github">GitHub</h1>
|
|
|
<p>External Secrets Operator integrates with GitHub to sync Kubernetes secrets with <a href="https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions">GitHub Actions secrets</a>.</p>
|
|
|
-<h3 id="limitations">Limitations</h3>
|
|
|
+<h2 id="limitations">Limitations</h2>
|
|
|
<p>The GitHub provider is <strong>write-only</strong>, designed specifically to <strong>create and update</strong> GitHub Actions secrets using the
|
|
|
<a href="https://docs.github.com/en/rest/actions/secrets">GitHub REST API</a>, and does not support <strong>fetching the secret values</strong>.</p>
|
|
|
-<h3 id="configuring-github-provider">Configuring GitHub provider</h3>
|
|
|
+<h2 id="configuring-github-provider">Configuring GitHub provider</h2>
|
|
|
<p>The GitHub API requires to install the ESO app to your GitHub organisation in order to use the GitHub provider features.</p>
|
|
|
-<h3 id="configuring-the-secret-store">Configuring the secret store</h3>
|
|
|
+<h2 id="configuring-the-secret-store">Configuring the secret store</h2>
|
|
|
<p>Verify that <code>github</code> provider is listed in the <code>Kind=SecretStore</code>. The properties <code>appID</code>, <code>installationID</code>, <code>organization</code> are required to register the provider. In addition, authentication has to be provided.</p>
|
|
|
<p>Optionally, to target <code>repository</code> and <code>environment</code> secrets, the fields <code>repository</code> and <code>environment</code> need also to be added.</p>
|
|
|
+<p>For organization secrets, the optional <code>orgSecretVisibility</code> field controls the visibility of secrets created via PushSecret. Valid values are <code>all</code> or <code>private</code>. When unset, new secrets are created with visibility <code>all</code> and existing secrets keep whatever visibility they already have in GitHub.</p>
|
|
|
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
|
|
|
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
<span class="nt">metadata</span><span class="p">:</span>
|
|
|
@@ -5148,8 +5119,8 @@
|
|
|
<span class="w"> </span><span class="c1">#repository: "Optional. set this for repository/environment secrets"</span>
|
|
|
<span class="w"> </span><span class="c1">#environment: "Optional. set this for environment secrets"</span>
|
|
|
</code></pre></div>
|
|
|
-<p><strong>NOTE:</strong> In case of a <code>ClusterSecretStore</code>, Be sure to provide <code>namespace</code> in <code>accessToken</code> with the namespace where the secret resides.</p>
|
|
|
-<h3 id="pushing-to-an-external-secret">Pushing to an external secret</h3>
|
|
|
+<p><strong>NOTE:</strong> In case of a <code>ClusterSecretStore</code>, Be sure to provide <code>namespace</code> in <code>auth.privateKey</code> with the namespace where the secret resides.</p>
|
|
|
+<h2 id="pushing-to-an-external-secret">Pushing to an external secret</h2>
|
|
|
<p>To sync a Kubernetes secret with an external GitHub secret we need to create a PushSecret, this means a <code>Kind=PushSecret</code> is needed.</p>
|
|
|
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1alpha1</span>
|
|
|
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">PushSecret</span>
|