helm-external-secrets/docs/spec.md

Packages:

• external-secrets.io/v1alpha1

external-secrets.io/v1alpha1

Package v1alpha1 contains resources for external-secrets

Resource Types:

AWSAuth

(Appears on: AWSProvider)

AWSAuth contains a secretRef for credentials.

AWSAuthSecretRef

Field	Description
secretRef

AWSAuthSecretRef

(Appears on: AWSAuth)

AWSAuthSecretRef holds secret references for aws credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.

github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
accessKeyIDSecretRef
The AccessKeyID is used for authentication
secretAccessKeySecretRef
The SecretAccessKey is used for authentication

AWSProvider

(Appears on: SecretStoreProvider)

AWSProvider configures a store to sync secrets with AWS.

AWSServiceType AWSAuth

Field	Description
service
Service defines which service should be used to fetch the secrets
auth
(Optional) Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials

role string (Optional)

Role is a Role ARN which the SecretManager provider will assume

region string

AWS Region to be used for the provider

AWSServiceType (string alias)

(Appears on: AWSProvider)

AWSServiceType is a enum that defines the service/API that is used to fetch the secrets.

Value	Description
"ParameterStore"	AWSServiceParameterStore is the AWS SystemsManager ParameterStore. see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
"SecretsManager"	AWSServiceSecretsManager is the AWS SecretsManager. see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

AzureKVAuth

(Appears on: AzureKVProvider)

Configuration used to authenticate with Azure.

github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
clientId
The Azure clientId of the service principle used for authentication.
clientSecret
The Azure ClientSecret of the service principle used for authentication.

AzureKVProvider

(Appears on: SecretStoreProvider)

Configures an store to sync secrets using Azure KV.

string string

Field	Description
vaultUrl
Vault Url from which the secrets to be fetched from.
tenantId
TenantID configures the Azure Tenant to send requests to.

authSecretRef AzureKVAuth

Auth configures how the operator authenticates with Azure.

ClusterSecretStore

ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Kubernetes meta/v1.ObjectMeta SecretStoreSpec SecretStoreProvider

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
string controller (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

status SecretStoreStatus

ExternalSecret

ExternalSecret is the Schema for the external-secrets API.

Kubernetes meta/v1.ObjectMeta ExternalSecretSpec ExternalSecretTarget Kubernetes meta/v1.Duration

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
SecretStoreRef secretStoreRef
target
refreshInterval
RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.

data []ExternalSecretData (Optional)

Data defines the connection between the Kubernetes Secret keys and the Provider data

dataFrom []ExternalSecretDataRemoteRef (Optional)

DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

status ExternalSecretStatus

ExternalSecretConditionType (string alias)

(Appears on: ExternalSecretStatusCondition)

Value	Description
"Ready"

ExternalSecretCreationPolicy (string alias)

(Appears on: ExternalSecretTarget)

ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.

Value	Description
"Merge"	Merge does not create the Secret, but merges the data fields to the Secret.
"None"	None does not create a Secret (future use with injector).
"Owner"	Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.

ExternalSecretData

(Appears on: ExternalSecretSpec)

ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.

string ExternalSecretDataRemoteRef

Field	Description
secretKey
remoteRef

ExternalSecretDataRemoteRef

(Appears on: ExternalSecretData, ExternalSecretSpec)

ExternalSecretDataRemoteRef defines Provider data location.

string string

Field	Description
key
Key is the key used in the Provider, mandatory
version
(Optional) Used to select a specific version of the Provider value, if supported

property string (Optional)

Used to select a specific property of the Provider value (if a map), if supported

ExternalSecretSpec

(Appears on: ExternalSecret)

ExternalSecretSpec defines the desired state of ExternalSecret.

SecretStoreRef ExternalSecretTarget

Field	Description
secretStoreRef
target

refreshInterval Kubernetes meta/v1.Duration

RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.

data []ExternalSecretData (Optional)

Data defines the connection between the Kubernetes Secret keys and the Provider data

dataFrom []ExternalSecretDataRemoteRef (Optional)

DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

ExternalSecretStatus

(Appears on: ExternalSecret)

Kubernetes meta/v1.Time string

Field	Description
refreshTime
refreshTime is the time and date the external secret was fetched and the target secret updated
syncedResourceVersion
SyncedResourceVersion keeps track of the last synced version

conditions []ExternalSecretStatusCondition (Optional)

ExternalSecretStatusCondition

(Appears on: ExternalSecretStatus)

ExternalSecretConditionType Kubernetes core/v1.ConditionStatus

Field	Description
type
status

reason string (Optional) message string (Optional) lastTransitionTime Kubernetes meta/v1.Time (Optional)

ExternalSecretTarget

(Appears on: ExternalSecretSpec)

ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.

string ExternalSecretCreationPolicy

Field	Description
name
(Optional) Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
creationPolicy
(Optional) CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’

template ExternalSecretTemplate (Optional)

Template defines a blueprint for the created Secret resource.

ExternalSecretTemplate

(Appears on: ExternalSecretTarget)

ExternalSecretTemplate defines a blueprint for the created Secret resource. we can not use native corev1.Secret, it will have empty ObjectMeta values: https://github.com/kubernetes-sigs/controller-tools/issues/448

Kubernetes core/v1.SecretType ExternalSecretTemplateMetadata

Field	Description
type
(Optional)
metadata
(Optional)

data map[string]string (Optional)

ExternalSecretTemplateMetadata

(Appears on: ExternalSecretTemplate)

ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.

map[string]string map[string]string

Field	Description
annotations
(Optional)
labels
(Optional)

GCPSMAuth

(Appears on: GCPSMProvider)

GCPSMAuthSecretRef

Field	Description
secretRef

GCPSMAuthSecretRef

(Appears on: GCPSMAuth)

github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
secretAccessKeySecretRef
(Optional) The SecretAccessKey is used for authentication

GCPSMProvider

(Appears on: SecretStoreProvider)

GCPSMProvider Configures a store to sync secrets using the GCP Secret Manager provider.

GCPSMAuth string

Field	Description
auth
Auth defines the information necessary to authenticate against GCP
projectID
ProjectID project where secret is located

GenericStore

GenericStore is a common interface for interacting with ClusterSecretStore or a namespaced SecretStore.

SecretStore

SecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Kubernetes meta/v1.ObjectMeta SecretStoreSpec SecretStoreProvider

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
string controller (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

status SecretStoreStatus

SecretStoreConditionType (string alias)

(Appears on: SecretStoreStatusCondition)

Value	Description
"Ready"

SecretStoreProvider

(Appears on: SecretStoreSpec)

SecretStoreProvider contains the provider-specific configration.

AWSProvider AzureKVProvider

Field	Description
aws
(Optional) AWS configures this store to sync secrets using AWS Secret Manager provider
azurekv
(Optional) AzureKV configures this store to sync secrets using Azure Key Vault provider

vault VaultProvider (Optional)

Vault configures this store to sync secrets using Hashi provider

gcpsm GCPSMProvider (Optional)

GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider

SecretStoreRef

(Appears on: ExternalSecretSpec)

SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.

string string

Field	Description
name
Name of the SecretStore resource
kind
(Optional) Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to SecretStore

SecretStoreSpec

(Appears on: ClusterSecretStore, SecretStore)

SecretStoreSpec defines the desired state of SecretStore.

string SecretStoreProvider

Field	Description
controller
(Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

SecretStoreStatus

(Appears on: ClusterSecretStore, SecretStore)

SecretStoreStatus defines the observed state of the SecretStore.

[]SecretStoreStatusCondition

Field	Description
conditions
(Optional)

SecretStoreStatusCondition

(Appears on: SecretStoreStatus)

SecretStoreConditionType Kubernetes core/v1.ConditionStatus

Field	Description
type
status

reason string (Optional) message string (Optional) lastTransitionTime Kubernetes meta/v1.Time (Optional)

VaultAppRole

(Appears on: VaultAuth)

VaultAppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.

string string

Field	Description
path
Path where the App Role authentication backend is mounted in Vault, e.g: “approle”
roleId
RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault.

secretRef github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role secret.

VaultAuth

(Appears on: VaultProvider)

VaultAuth is the configuration used to authenticate with a Vault server. Only one of tokenSecretRef, appRole, kubernetes, ldap or jwt can be specified.

github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector VaultAppRole

Field	Description
tokenSecretRef
(Optional) TokenSecretRef authenticates with Vault by presenting a token.
appRole
(Optional) AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.

kubernetes VaultKubernetesAuth (Optional)

Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.

ldap VaultLdapAuth (Optional)

Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method

jwt VaultJwtAuth (Optional)

Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method

VaultJwtAuth

(Appears on: VaultAuth)

VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication method, with the role name and token stored in a Kubernetes Secret resource.

string github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
role
(Optional) Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method
secretRef
SecretRef to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method

VaultKVStoreVersion (string alias)

(Appears on: VaultProvider)

Value	Description
"v1"
"v2"

VaultKubernetesAuth

(Appears on: VaultAuth)

Authenticate against Vault using a Kubernetes ServiceAccount token stored in a Secret.

string github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector

Field	Description
mountPath
Path where the Kubernetes authentication backend is mounted in Vault, e.g: “kubernetes”
serviceAccountRef
(Optional) Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead.

secretRef github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector (Optional)

Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used.

role string

A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.

VaultLdapAuth

(Appears on: VaultAuth)

VaultLdapAuth authenticates with Vault using the LDAP authentication method, with the username and password stored in a Kubernetes Secret resource.

string github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
username
Username is a LDAP user name used to authenticate using the LDAP Vault authentication method
secretRef
SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method

VaultProvider

(Appears on: SecretStoreProvider)

Configures an store to sync secrets using a HashiCorp Vault KV backend.

VaultAuth string

Field	Description
auth
Auth configures how secret-manager authenticates with the Vault server.
server
Server is the connection address for the Vault server, e.g: “https://vault.example.com:8200”.

path string

Path is the mount path of the Vault KV backend endpoint, e.g: “secret”. The v2 KV secret engine version specific “/data” path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path.

version VaultKVStoreVersion

Version is the Vault KV secret engine version. This can be either “v1” or “v2”. Version defaults to “v2”.

namespace string (Optional)

Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: “ns1”. More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces

caBundle []byte (Optional)

PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection.

---

Generated with gen-crd-api-reference-docs.