GitHub

External Secrets Operator integrates with GitHub to sync Kubernetes secrets with GitHub Actions secrets.

Limitations

The GitHub provider is write-only, designed specifically to create and update GitHub Actions secrets using the GitHub REST API, and does not support fetching the secret values.

Configuring GitHub provider

The GitHub API requires to install the ESO app to your GitHub organisation in order to use the GitHub provider features.

Configuring the secret store

Verify that github provider is listed in the Kind=SecretStore. The properties appID, installationID, organization are required to register the provider. In addition, authentication has to be provided.

Optionally, to target repository and environment secrets, the fields repository and environment need also to be added.

For organization secrets, the optional orgSecretVisibility field controls the visibility of secrets created via PushSecret. Valid values are all or private. When unset, new secrets are created with visibility all and existing secrets keep whatever visibility they already have in GitHub.

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: github
spec:
  provider:
    # provider type: github
    github:
      appID: "**app ID goes here**"
      # url: Default "https://github.com/", for enterprise Github instances uncomment and add your domain like "https://github.domain.com/"
      # uploadURL: Default "https://github.com"
      auth:
        privateKey:
          name: github-app-private-key
          key: privateKey.pem
      installationID: "**installation ID goes here**"
      organization: "Github **organization name goes here**"
      #repository: "Optional. set this for repository/environment secrets"
      #environment: "Optional. set this for environment secrets"

NOTE: In case of a ClusterSecretStore, Be sure to provide namespace in auth.privateKey with the namespace where the secret resides.

Pushing to an external secret

To sync a Kubernetes secret with an external GitHub secret we need to create a PushSecret, this means a Kind=PushSecret is needed.

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: github-push-secret-example
spec:
  deletionPolicy: Delete
  refreshInterval: 10m0s # Refresh interval for which push secret will reconcile
  secretStoreRefs: # A list of secret stores to push secrets to
    - name: github # Must match SecretStore on the cluster
      kind: SecretStore
  selector:
    secret:
      name: EXTSERCRET # Remote Github actions secret that we want to sync with the kubernetes secret
  data:
    - match:
        secretKey: extsecret # Source Kubernetes secret key containing the secret
        remoteRef:
          remoteKey: EXTSECRET # Key of the kubernetes secret to push