| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159416041614162416341644165416641674168416941704171417241734174417541764177417841794180418141824183418441854186418741884189419041914192419341944195419641974198419942004201420242034204420542064207420842094210421142124213421442154216421742184219422042214222422342244225422642274228422942304231423242334234423542364237423842394240424142424243424442454246424742484249425042514252425342544255425642574258425942604261426242634264426542664267426842694270427142724273427442754276427742784279428042814282428342844285428642874288428942904291429242934294429542964297429842994300430143024303430443054306430743084309431043114312431343144315431643174318431943204321432243234324432543264327432843294330433143324333433443354336433743384339434043414342434343444345434643474348434943504351435243534354435543564357435843594360436143624363436443654366436743684369437043714372437343744375437643774378437943804381438243834384438543864387438843894390439143924393439443954396439743984399440044014402440344044405440644074408440944104411441244134414441544164417441844194420442144224423442444254426442744284429443044314432443344344435443644374438443944404441444244434444444544464447444844494450445144524453445444554456445744584459446044614462446344644465446644674468446944704471447244734474447544764477447844794480448144824483448444854486448744884489449044914492449344944495449644974498449945004501450245034504450545064507450845094510451145124513451445154516451745184519452045214522452345244525452645274528452945304531453245334534453545364537453845394540454145424543454445454546454745484549455045514552455345544555455645574558455945604561456245634564456545664567456845694570457145724573457445754576457745784579458045814582458345844585458645874588458945904591459245934594459545964597459845994600460146024603460446054606460746084609461046114612461346144615461646174618461946204621462246234624462546264627462846294630463146324633463446354636463746384639464046414642464346444645464646474648464946504651465246534654465546564657465846594660466146624663466446654666466746684669467046714672467346744675467646774678467946804681468246834684468546864687468846894690469146924693469446954696469746984699470047014702470347044705470647074708470947104711471247134714471547164717471847194720472147224723472447254726472747284729473047314732473347344735473647374738473947404741474247434744474547464747474847494750475147524753475447554756475747584759476047614762476347644765476647674768476947704771477247734774477547764777477847794780478147824783478447854786478747884789479047914792479347944795479647974798479948004801480248034804480548064807480848094810481148124813481448154816481748184819482048214822482348244825482648274828482948304831483248334834483548364837483848394840484148424843484448454846484748484849485048514852485348544855485648574858485948604861486248634864486548664867486848694870487148724873487448754876487748784879488048814882488348844885488648874888488948904891489248934894489548964897489848994900490149024903490449054906490749084909491049114912491349144915491649174918491949204921492249234924492549264927492849294930493149324933493449354936493749384939494049414942494349444945494649474948494949504951495249534954495549564957495849594960496149624963496449654966496749684969497049714972497349744975497649774978497949804981498249834984498549864987498849894990499149924993499449954996499749984999500050015002500350045005500650075008500950105011501250135014501550165017501850195020502150225023502450255026502750285029503050315032503350345035503650375038503950405041504250435044504550465047504850495050505150525053505450555056505750585059506050615062506350645065506650675068506950705071507250735074507550765077507850795080508150825083508450855086508750885089509050915092509350945095509650975098509951005101510251035104510551065107510851095110511151125113511451155116511751185119512051215122512351245125512651275128512951305131513251335134513551365137513851395140514151425143514451455146514751485149515051515152515351545155515651575158515951605161516251635164516551665167516851695170517151725173517451755176517751785179518051815182518351845185518651875188518951905191519251935194519551965197519851995200520152025203520452055206520752085209521052115212521352145215521652175218521952205221522252235224522552265227522852295230523152325233523452355236523752385239524052415242524352445245524652475248524952505251525252535254525552565257525852595260526152625263526452655266526752685269527052715272527352745275527652775278527952805281528252835284528552865287528852895290529152925293529452955296529752985299530053015302530353045305530653075308530953105311531253135314531553165317531853195320532153225323532453255326532753285329533053315332533353345335533653375338533953405341534253435344534553465347534853495350535153525353535453555356535753585359536053615362536353645365536653675368536953705371537253735374537553765377537853795380538153825383538453855386538753885389539053915392539353945395539653975398539954005401540254035404540554065407540854095410541154125413541454155416541754185419542054215422542354245425542654275428542954305431543254335434543554365437543854395440544154425443544454455446544754485449545054515452545354545455545654575458545954605461546254635464546554665467546854695470547154725473547454755476547754785479548054815482548354845485548654875488548954905491549254935494549554965497549854995500550155025503550455055506550755085509551055115512551355145515551655175518551955205521552255235524552555265527552855295530553155325533553455355536553755385539554055415542554355445545554655475548554955505551555255535554555555565557555855595560556155625563556455655566556755685569557055715572557355745575557655775578557955805581558255835584558555865587558855895590559155925593559455955596559755985599560056015602560356045605560656075608560956105611561256135614561556165617561856195620562156225623562456255626562756285629563056315632563356345635563656375638563956405641564256435644564556465647564856495650565156525653565456555656565756585659566056615662566356645665566656675668566956705671567256735674567556765677567856795680568156825683568456855686568756885689569056915692569356945695569656975698569957005701570257035704570557065707570857095710571157125713571457155716571757185719572057215722572357245725572657275728572957305731573257335734573557365737573857395740574157425743574457455746574757485749575057515752575357545755575657575758575957605761576257635764576557665767576857695770577157725773577457755776577757785779578057815782578357845785578657875788578957905791579257935794579557965797579857995800580158025803580458055806580758085809581058115812581358145815581658175818581958205821582258235824582558265827582858295830583158325833583458355836583758385839584058415842584358445845584658475848584958505851585258535854585558565857585858595860586158625863586458655866586758685869587058715872587358745875587658775878587958805881588258835884588558865887588858895890589158925893589458955896589758985899590059015902590359045905590659075908590959105911591259135914591559165917591859195920592159225923592459255926592759285929593059315932593359345935593659375938593959405941594259435944594559465947594859495950595159525953595459555956595759585959596059615962596359645965596659675968596959705971597259735974597559765977597859795980598159825983598459855986598759885989599059915992599359945995599659975998599960006001600260036004600560066007600860096010601160126013601460156016601760186019602060216022602360246025602660276028602960306031603260336034603560366037603860396040604160426043604460456046604760486049605060516052605360546055605660576058605960606061606260636064606560666067606860696070607160726073607460756076607760786079608060816082608360846085608660876088608960906091609260936094609560966097609860996100610161026103610461056106610761086109611061116112611361146115611661176118611961206121612261236124612561266127612861296130613161326133613461356136613761386139614061416142614361446145614661476148614961506151615261536154615561566157615861596160616161626163616461656166616761686169617061716172617361746175617661776178617961806181618261836184618561866187618861896190619161926193619461956196619761986199620062016202620362046205620662076208620962106211621262136214621562166217621862196220622162226223622462256226622762286229623062316232623362346235623662376238623962406241624262436244624562466247624862496250625162526253625462556256625762586259626062616262626362646265626662676268626962706271627262736274627562766277627862796280628162826283628462856286628762886289629062916292629362946295629662976298629963006301630263036304630563066307630863096310631163126313631463156316631763186319632063216322632363246325632663276328632963306331633263336334633563366337633863396340634163426343634463456346634763486349635063516352635363546355635663576358635963606361636263636364636563666367636863696370637163726373637463756376637763786379638063816382638363846385638663876388638963906391639263936394639563966397639863996400640164026403640464056406640764086409641064116412641364146415641664176418641964206421642264236424642564266427642864296430643164326433643464356436643764386439644064416442644364446445644664476448644964506451645264536454645564566457645864596460646164626463646464656466646764686469647064716472647364746475647664776478647964806481648264836484648564866487648864896490649164926493649464956496649764986499650065016502650365046505650665076508650965106511651265136514651565166517651865196520652165226523652465256526652765286529653065316532653365346535653665376538653965406541654265436544654565466547654865496550655165526553655465556556655765586559656065616562656365646565656665676568656965706571657265736574657565766577657865796580658165826583658465856586658765886589659065916592659365946595659665976598659966006601660266036604660566066607660866096610661166126613661466156616661766186619662066216622662366246625662666276628662966306631663266336634663566366637663866396640664166426643664466456646664766486649665066516652665366546655665666576658665966606661666266636664666566666667666866696670667166726673667466756676667766786679668066816682668366846685668666876688668966906691669266936694669566966697669866996700670167026703670467056706670767086709671067116712671367146715671667176718671967206721672267236724672567266727672867296730673167326733673467356736673767386739674067416742674367446745674667476748674967506751675267536754675567566757675867596760676167626763676467656766676767686769677067716772677367746775677667776778677967806781678267836784678567866787678867896790679167926793679467956796679767986799680068016802680368046805680668076808680968106811681268136814681568166817681868196820682168226823682468256826682768286829683068316832683368346835683668376838683968406841684268436844684568466847684868496850685168526853685468556856685768586859686068616862686368646865686668676868686968706871687268736874687568766877687868796880688168826883688468856886688768886889689068916892689368946895689668976898689969006901690269036904690569066907690869096910691169126913691469156916691769186919692069216922692369246925692669276928692969306931693269336934693569366937693869396940694169426943694469456946694769486949695069516952695369546955695669576958695969606961696269636964696569666967696869696970697169726973697469756976697769786979698069816982698369846985698669876988698969906991699269936994699569966997699869997000700170027003700470057006700770087009701070117012701370147015701670177018701970207021702270237024702570267027702870297030703170327033703470357036703770387039704070417042704370447045704670477048704970507051705270537054705570567057705870597060706170627063706470657066706770687069707070717072707370747075707670777078707970807081708270837084708570867087708870897090709170927093709470957096709770987099710071017102710371047105710671077108710971107111711271137114711571167117711871197120712171227123712471257126712771287129713071317132713371347135713671377138713971407141714271437144714571467147714871497150715171527153715471557156715771587159716071617162716371647165716671677168716971707171717271737174717571767177717871797180718171827183718471857186718771887189719071917192719371947195719671977198719972007201720272037204720572067207720872097210721172127213721472157216721772187219722072217222722372247225722672277228722972307231723272337234723572367237723872397240724172427243724472457246724772487249725072517252725372547255725672577258725972607261726272637264726572667267726872697270727172727273727472757276727772787279728072817282728372847285728672877288728972907291729272937294729572967297729872997300730173027303730473057306730773087309731073117312731373147315731673177318731973207321732273237324732573267327732873297330733173327333733473357336733773387339734073417342734373447345734673477348734973507351735273537354735573567357735873597360736173627363736473657366736773687369737073717372737373747375737673777378737973807381738273837384738573867387738873897390739173927393739473957396739773987399740074017402740374047405740674077408740974107411741274137414741574167417741874197420742174227423742474257426742774287429743074317432743374347435743674377438743974407441744274437444744574467447744874497450745174527453745474557456745774587459746074617462746374647465746674677468746974707471747274737474747574767477747874797480748174827483748474857486748774887489749074917492749374947495749674977498749975007501750275037504750575067507750875097510751175127513751475157516751775187519752075217522752375247525752675277528752975307531753275337534753575367537753875397540754175427543754475457546754775487549755075517552755375547555755675577558755975607561756275637564756575667567756875697570757175727573757475757576757775787579758075817582758375847585758675877588758975907591759275937594759575967597759875997600760176027603760476057606760776087609761076117612761376147615761676177618761976207621762276237624762576267627762876297630763176327633763476357636763776387639764076417642764376447645764676477648764976507651765276537654765576567657765876597660766176627663766476657666766776687669767076717672767376747675767676777678767976807681768276837684768576867687768876897690769176927693769476957696769776987699770077017702770377047705770677077708770977107711771277137714771577167717771877197720772177227723772477257726772777287729773077317732773377347735773677377738773977407741774277437744774577467747774877497750775177527753775477557756775777587759776077617762776377647765776677677768776977707771777277737774777577767777777877797780778177827783778477857786778777887789779077917792779377947795779677977798779978007801780278037804780578067807780878097810781178127813781478157816781778187819782078217822782378247825782678277828782978307831783278337834783578367837783878397840784178427843784478457846784778487849785078517852785378547855785678577858785978607861786278637864786578667867786878697870787178727873787478757876787778787879788078817882788378847885788678877888788978907891789278937894789578967897789878997900790179027903790479057906790779087909791079117912791379147915791679177918791979207921792279237924792579267927792879297930793179327933793479357936793779387939794079417942794379447945794679477948794979507951795279537954795579567957795879597960796179627963796479657966796779687969797079717972797379747975797679777978797979807981798279837984798579867987798879897990799179927993799479957996799779987999800080018002800380048005800680078008800980108011801280138014801580168017801880198020802180228023802480258026802780288029803080318032803380348035803680378038803980408041804280438044804580468047804880498050805180528053805480558056805780588059806080618062806380648065806680678068806980708071807280738074807580768077807880798080808180828083808480858086808780888089809080918092809380948095809680978098809981008101810281038104810581068107810881098110811181128113811481158116811781188119812081218122812381248125812681278128812981308131813281338134813581368137813881398140814181428143814481458146814781488149815081518152815381548155815681578158815981608161816281638164816581668167816881698170817181728173817481758176817781788179818081818182818381848185818681878188818981908191819281938194819581968197819881998200820182028203820482058206820782088209821082118212821382148215821682178218821982208221822282238224822582268227822882298230823182328233823482358236823782388239824082418242824382448245824682478248824982508251825282538254825582568257825882598260826182628263826482658266826782688269827082718272827382748275827682778278827982808281828282838284828582868287828882898290829182928293829482958296829782988299830083018302830383048305830683078308830983108311831283138314831583168317831883198320832183228323832483258326832783288329833083318332833383348335833683378338833983408341834283438344834583468347834883498350835183528353835483558356835783588359836083618362836383648365836683678368836983708371837283738374837583768377837883798380838183828383838483858386838783888389839083918392839383948395839683978398839984008401840284038404840584068407840884098410841184128413841484158416841784188419842084218422842384248425842684278428842984308431843284338434843584368437843884398440844184428443844484458446844784488449845084518452845384548455845684578458845984608461846284638464846584668467846884698470847184728473847484758476847784788479848084818482848384848485848684878488848984908491849284938494849584968497849884998500850185028503850485058506850785088509851085118512851385148515851685178518851985208521852285238524852585268527852885298530853185328533853485358536853785388539854085418542854385448545854685478548854985508551855285538554855585568557855885598560856185628563856485658566856785688569857085718572857385748575857685778578857985808581858285838584858585868587858885898590859185928593859485958596859785988599860086018602860386048605860686078608860986108611861286138614861586168617861886198620862186228623862486258626862786288629863086318632863386348635863686378638863986408641864286438644864586468647864886498650865186528653865486558656865786588659866086618662866386648665866686678668866986708671867286738674867586768677867886798680868186828683868486858686868786888689869086918692869386948695869686978698869987008701870287038704870587068707870887098710871187128713871487158716871787188719872087218722872387248725872687278728872987308731873287338734873587368737873887398740874187428743874487458746874787488749875087518752875387548755875687578758875987608761876287638764876587668767876887698770877187728773877487758776877787788779878087818782878387848785878687878788878987908791879287938794879587968797879887998800880188028803880488058806880788088809881088118812881388148815881688178818881988208821882288238824882588268827882888298830883188328833883488358836883788388839884088418842884388448845884688478848884988508851885288538854885588568857885888598860886188628863886488658866886788688869887088718872887388748875887688778878887988808881888288838884888588868887888888898890889188928893889488958896889788988899890089018902890389048905890689078908890989108911891289138914891589168917891889198920892189228923892489258926892789288929893089318932893389348935893689378938893989408941894289438944894589468947894889498950895189528953895489558956895789588959896089618962896389648965896689678968896989708971897289738974897589768977897889798980898189828983898489858986898789888989899089918992899389948995899689978998899990009001900290039004900590069007900890099010901190129013901490159016901790189019902090219022902390249025902690279028902990309031903290339034903590369037903890399040904190429043904490459046904790489049905090519052905390549055905690579058905990609061906290639064906590669067906890699070907190729073907490759076907790789079908090819082908390849085908690879088908990909091909290939094909590969097909890999100910191029103910491059106910791089109911091119112911391149115911691179118911991209121912291239124912591269127912891299130913191329133913491359136913791389139914091419142914391449145914691479148914991509151915291539154915591569157915891599160916191629163916491659166916791689169917091719172917391749175917691779178917991809181918291839184918591869187918891899190919191929193919491959196919791989199920092019202920392049205920692079208920992109211921292139214921592169217921892199220922192229223922492259226922792289229923092319232923392349235923692379238923992409241924292439244924592469247924892499250925192529253925492559256925792589259926092619262926392649265926692679268926992709271927292739274927592769277927892799280928192829283928492859286928792889289929092919292929392949295929692979298929993009301930293039304930593069307930893099310931193129313931493159316931793189319932093219322932393249325932693279328932993309331933293339334933593369337933893399340934193429343934493459346934793489349935093519352935393549355935693579358935993609361936293639364936593669367936893699370937193729373937493759376937793789379938093819382938393849385938693879388938993909391939293939394939593969397939893999400940194029403940494059406940794089409941094119412941394149415941694179418941994209421942294239424942594269427942894299430943194329433943494359436943794389439944094419442944394449445944694479448944994509451945294539454945594569457945894599460946194629463946494659466946794689469947094719472947394749475947694779478947994809481948294839484948594869487948894899490949194929493949494959496949794989499950095019502950395049505950695079508950995109511951295139514951595169517951895199520952195229523952495259526952795289529953095319532953395349535953695379538953995409541954295439544954595469547954895499550955195529553955495559556955795589559956095619562956395649565956695679568956995709571957295739574957595769577957895799580958195829583958495859586958795889589959095919592959395949595959695979598959996009601960296039604960596069607960896099610961196129613961496159616961796189619962096219622962396249625962696279628962996309631963296339634963596369637963896399640964196429643964496459646964796489649965096519652965396549655965696579658965996609661966296639664966596669667966896699670967196729673967496759676967796789679968096819682968396849685968696879688968996909691969296939694969596969697969896999700970197029703970497059706970797089709971097119712971397149715971697179718971997209721972297239724972597269727972897299730973197329733973497359736973797389739974097419742974397449745974697479748974997509751975297539754975597569757975897599760976197629763976497659766976797689769977097719772977397749775977697779778977997809781978297839784978597869787978897899790979197929793979497959796979797989799980098019802980398049805980698079808980998109811981298139814981598169817981898199820982198229823982498259826982798289829983098319832983398349835983698379838983998409841984298439844984598469847984898499850985198529853985498559856985798589859986098619862986398649865986698679868986998709871987298739874987598769877987898799880988198829883988498859886988798889889989098919892989398949895989698979898989999009901990299039904990599069907990899099910991199129913991499159916991799189919992099219922992399249925992699279928992999309931993299339934993599369937993899399940994199429943994499459946994799489949995099519952995399549955995699579958995999609961996299639964996599669967996899699970997199729973997499759976997799789979998099819982998399849985998699879988998999909991999299939994999599969997999899991000010001100021000310004100051000610007100081000910010100111001210013100141001510016100171001810019100201002110022100231002410025100261002710028100291003010031100321003310034100351003610037100381003910040100411004210043100441004510046100471004810049100501005110052100531005410055100561005710058100591006010061100621006310064100651006610067100681006910070100711007210073100741007510076100771007810079100801008110082100831008410085100861008710088100891009010091100921009310094100951009610097100981009910100101011010210103101041010510106101071010810109101101011110112101131011410115101161011710118101191012010121101221012310124101251012610127101281012910130101311013210133101341013510136101371013810139101401014110142101431014410145101461014710148101491015010151101521015310154101551015610157101581015910160101611016210163101641016510166101671016810169101701017110172101731017410175101761017710178101791018010181101821018310184101851018610187101881018910190101911019210193101941019510196101971019810199102001020110202102031020410205102061020710208102091021010211102121021310214102151021610217102181021910220102211022210223102241022510226102271022810229102301023110232102331023410235102361023710238102391024010241102421024310244102451024610247102481024910250102511025210253102541025510256102571025810259102601026110262102631026410265102661026710268102691027010271102721027310274102751027610277102781027910280102811028210283102841028510286102871028810289102901029110292102931029410295102961029710298102991030010301103021030310304103051030610307103081030910310103111031210313103141031510316103171031810319103201032110322103231032410325103261032710328103291033010331103321033310334103351033610337103381033910340103411034210343103441034510346103471034810349103501035110352103531035410355103561035710358103591036010361103621036310364103651036610367103681036910370103711037210373103741037510376103771037810379103801038110382103831038410385103861038710388103891039010391103921039310394103951039610397103981039910400104011040210403104041040510406104071040810409104101041110412104131041410415104161041710418104191042010421104221042310424104251042610427104281042910430104311043210433104341043510436104371043810439104401044110442104431044410445104461044710448104491045010451104521045310454104551045610457104581045910460104611046210463104641046510466104671046810469104701047110472104731047410475104761047710478104791048010481104821048310484104851048610487104881048910490104911049210493104941049510496104971049810499105001050110502105031050410505105061050710508105091051010511105121051310514105151051610517105181051910520105211052210523105241052510526105271052810529105301053110532105331053410535105361053710538105391054010541105421054310544105451054610547105481054910550105511055210553105541055510556105571055810559105601056110562105631056410565105661056710568105691057010571105721057310574105751057610577105781057910580105811058210583105841058510586105871058810589105901059110592105931059410595105961059710598105991060010601106021060310604106051060610607106081060910610106111061210613106141061510616106171061810619106201062110622106231062410625106261062710628106291063010631106321063310634106351063610637106381063910640106411064210643106441064510646106471064810649106501065110652106531065410655106561065710658106591066010661106621066310664106651066610667106681066910670106711067210673106741067510676106771067810679106801068110682106831068410685106861068710688106891069010691106921069310694106951069610697106981069910700107011070210703107041070510706107071070810709107101071110712107131071410715107161071710718107191072010721107221072310724107251072610727107281072910730107311073210733107341073510736107371073810739107401074110742107431074410745107461074710748107491075010751107521075310754107551075610757107581075910760107611076210763107641076510766107671076810769107701077110772107731077410775107761077710778107791078010781107821078310784107851078610787107881078910790107911079210793107941079510796107971079810799108001080110802108031080410805108061080710808108091081010811108121081310814108151081610817108181081910820108211082210823108241082510826108271082810829108301083110832108331083410835108361083710838108391084010841108421084310844108451084610847108481084910850108511085210853108541085510856108571085810859108601086110862108631086410865108661086710868108691087010871108721087310874108751087610877108781087910880108811088210883108841088510886108871088810889108901089110892108931089410895108961089710898108991090010901109021090310904109051090610907109081090910910109111091210913109141091510916109171091810919109201092110922109231092410925109261092710928109291093010931109321093310934109351093610937109381093910940109411094210943109441094510946109471094810949109501095110952109531095410955109561095710958109591096010961109621096310964109651096610967109681096910970109711097210973109741097510976109771097810979109801098110982109831098410985109861098710988109891099010991109921099310994109951099610997109981099911000110011100211003110041100511006110071100811009110101101111012110131101411015110161101711018110191102011021110221102311024110251102611027110281102911030110311103211033110341103511036110371103811039110401104111042110431104411045110461104711048110491105011051110521105311054110551105611057110581105911060110611106211063110641106511066110671106811069110701107111072110731107411075110761107711078110791108011081110821108311084110851108611087110881108911090110911109211093110941109511096110971109811099111001110111102111031110411105111061110711108111091111011111111121111311114111151111611117111181111911120111211112211123111241112511126111271112811129111301113111132111331113411135111361113711138111391114011141111421114311144111451114611147111481114911150111511115211153111541115511156111571115811159111601116111162111631116411165111661116711168111691117011171111721117311174111751117611177111781117911180111811118211183111841118511186111871118811189111901119111192111931119411195111961119711198111991120011201112021120311204112051120611207112081120911210112111121211213112141121511216112171121811219112201122111222112231122411225112261122711228112291123011231112321123311234112351123611237112381123911240112411124211243112441124511246112471124811249112501125111252112531125411255112561125711258112591126011261112621126311264112651126611267112681126911270112711127211273112741127511276112771127811279112801128111282112831128411285112861128711288112891129011291112921129311294112951129611297112981129911300113011130211303113041130511306113071130811309113101131111312113131131411315113161131711318113191132011321113221132311324113251132611327113281132911330113311133211333113341133511336113371133811339113401134111342113431134411345113461134711348113491135011351113521135311354113551135611357113581135911360113611136211363113641136511366113671136811369113701137111372113731137411375113761137711378113791138011381113821138311384113851138611387113881138911390113911139211393113941139511396113971139811399114001140111402114031140411405114061140711408114091141011411114121141311414114151141611417114181141911420114211142211423114241142511426114271142811429114301143111432114331143411435114361143711438114391144011441114421144311444114451144611447114481144911450114511145211453114541145511456114571145811459114601146111462114631146411465114661146711468114691147011471114721147311474114751147611477114781147911480114811148211483114841148511486114871148811489114901149111492114931149411495114961149711498114991150011501115021150311504115051150611507115081150911510115111151211513115141151511516115171151811519115201152111522115231152411525115261152711528115291153011531115321153311534115351153611537115381153911540115411154211543115441154511546115471154811549115501155111552115531155411555115561155711558115591156011561115621156311564115651156611567115681156911570115711157211573115741157511576115771157811579115801158111582115831158411585115861158711588115891159011591115921159311594115951159611597115981159911600116011160211603116041160511606116071160811609116101161111612116131161411615116161161711618116191162011621116221162311624116251162611627116281162911630116311163211633116341163511636116371163811639116401164111642116431164411645116461164711648116491165011651116521165311654116551165611657116581165911660116611166211663116641166511666116671166811669116701167111672116731167411675116761167711678116791168011681116821168311684116851168611687116881168911690116911169211693116941169511696116971169811699117001170111702117031170411705117061170711708117091171011711117121171311714117151171611717117181171911720117211172211723117241172511726117271172811729117301173111732117331173411735117361173711738117391174011741117421174311744117451174611747117481174911750117511175211753117541175511756117571175811759117601176111762117631176411765117661176711768117691177011771117721177311774117751177611777117781177911780117811178211783117841178511786117871178811789117901179111792117931179411795117961179711798117991180011801118021180311804118051180611807118081180911810118111181211813118141181511816118171181811819118201182111822118231182411825118261182711828118291183011831118321183311834118351183611837118381183911840118411184211843118441184511846118471184811849118501185111852118531185411855118561185711858118591186011861118621186311864118651186611867118681186911870118711187211873118741187511876118771187811879118801188111882118831188411885118861188711888118891189011891118921189311894118951189611897118981189911900119011190211903119041190511906119071190811909119101191111912119131191411915119161191711918119191192011921119221192311924119251192611927119281192911930119311193211933119341193511936119371193811939119401194111942119431194411945119461194711948119491195011951119521195311954119551195611957119581195911960119611196211963119641196511966119671196811969119701197111972119731197411975119761197711978119791198011981119821198311984119851198611987119881198911990119911199211993119941199511996119971199811999120001200112002120031200412005120061200712008120091201012011120121201312014120151201612017120181201912020120211202212023120241202512026120271202812029120301203112032120331203412035120361203712038120391204012041120421204312044120451204612047120481204912050120511205212053120541205512056120571205812059120601206112062120631206412065120661206712068120691207012071120721207312074120751207612077120781207912080120811208212083120841208512086120871208812089120901209112092120931209412095120961209712098120991210012101121021210312104121051210612107121081210912110121111211212113121141211512116121171211812119121201212112122121231212412125121261212712128121291213012131121321213312134121351213612137121381213912140121411214212143121441214512146121471214812149121501215112152121531215412155121561215712158121591216012161121621216312164121651216612167121681216912170121711217212173121741217512176121771217812179121801218112182121831218412185121861218712188121891219012191121921219312194121951219612197121981219912200122011220212203122041220512206122071220812209122101221112212122131221412215122161221712218122191222012221122221222312224122251222612227122281222912230122311223212233122341223512236122371223812239122401224112242122431224412245122461224712248122491225012251122521225312254122551225612257122581225912260122611226212263122641226512266122671226812269122701227112272122731227412275122761227712278122791228012281122821228312284122851228612287122881228912290122911229212293122941229512296122971229812299123001230112302123031230412305123061230712308123091231012311123121231312314123151231612317123181231912320123211232212323123241232512326123271232812329123301233112332123331233412335123361233712338123391234012341123421234312344123451234612347123481234912350123511235212353123541235512356123571235812359123601236112362123631236412365123661236712368123691237012371123721237312374123751237612377123781237912380123811238212383123841238512386123871238812389123901239112392123931239412395123961239712398123991240012401124021240312404124051240612407124081240912410124111241212413124141241512416124171241812419124201242112422124231242412425124261242712428124291243012431124321243312434124351243612437124381243912440124411244212443124441244512446124471244812449124501245112452124531245412455124561245712458124591246012461124621246312464124651246612467124681246912470124711247212473124741247512476124771247812479124801248112482124831248412485124861248712488124891249012491124921249312494124951249612497124981249912500125011250212503125041250512506125071250812509125101251112512125131251412515125161251712518125191252012521125221252312524125251252612527125281252912530125311253212533125341253512536125371253812539125401254112542125431254412545125461254712548125491255012551125521255312554125551255612557125581255912560125611256212563125641256512566125671256812569125701257112572125731257412575125761257712578125791258012581125821258312584125851258612587125881258912590125911259212593125941259512596125971259812599126001260112602126031260412605126061260712608126091261012611126121261312614126151261612617126181261912620126211262212623126241262512626126271262812629126301263112632126331263412635126361263712638126391264012641126421264312644126451264612647126481264912650126511265212653126541265512656126571265812659126601266112662126631266412665126661266712668126691267012671126721267312674126751267612677126781267912680126811268212683126841268512686126871268812689126901269112692126931269412695126961269712698126991270012701127021270312704127051270612707127081270912710127111271212713127141271512716127171271812719127201272112722127231272412725127261272712728127291273012731127321273312734127351273612737127381273912740127411274212743127441274512746127471274812749127501275112752127531275412755127561275712758127591276012761127621276312764127651276612767127681276912770127711277212773127741277512776127771277812779127801278112782127831278412785127861278712788127891279012791127921279312794127951279612797127981279912800128011280212803128041280512806128071280812809128101281112812128131281412815128161281712818128191282012821128221282312824128251282612827128281282912830128311283212833128341283512836128371283812839128401284112842128431284412845128461284712848128491285012851128521285312854128551285612857128581285912860128611286212863128641286512866128671286812869128701287112872128731287412875128761287712878128791288012881128821288312884128851288612887128881288912890128911289212893128941289512896128971289812899129001290112902129031290412905129061290712908129091291012911129121291312914129151291612917129181291912920129211292212923129241292512926129271292812929129301293112932129331293412935129361293712938129391294012941129421294312944129451294612947129481294912950129511295212953129541295512956129571295812959129601296112962129631296412965129661296712968129691297012971129721297312974129751297612977129781297912980129811298212983129841298512986129871298812989129901299112992129931299412995129961299712998129991300013001130021300313004130051300613007130081300913010130111301213013130141301513016130171301813019130201302113022130231302413025130261302713028130291303013031130321303313034130351303613037130381303913040130411304213043130441304513046130471304813049130501305113052130531305413055130561305713058130591306013061130621306313064130651306613067130681306913070130711307213073130741307513076130771307813079130801308113082130831308413085130861308713088130891309013091130921309313094130951309613097130981309913100131011310213103131041310513106131071310813109131101311113112131131311413115131161311713118131191312013121131221312313124131251312613127131281312913130131311313213133131341313513136131371313813139131401314113142131431314413145131461314713148131491315013151131521315313154131551315613157131581315913160131611316213163131641316513166131671316813169131701317113172131731317413175131761317713178131791318013181131821318313184131851318613187131881318913190131911319213193131941319513196131971319813199132001320113202132031320413205132061320713208132091321013211132121321313214132151321613217132181321913220132211322213223132241322513226132271322813229132301323113232132331323413235132361323713238132391324013241132421324313244132451324613247132481324913250132511325213253132541325513256132571325813259132601326113262132631326413265132661326713268132691327013271132721327313274132751327613277132781327913280132811328213283132841328513286132871328813289132901329113292132931329413295132961329713298132991330013301133021330313304133051330613307133081330913310133111331213313133141331513316133171331813319133201332113322133231332413325133261332713328133291333013331133321333313334133351333613337133381333913340133411334213343133441334513346133471334813349133501335113352133531335413355133561335713358133591336013361133621336313364133651336613367133681336913370133711337213373133741337513376133771337813379133801338113382133831338413385133861338713388133891339013391133921339313394133951339613397133981339913400134011340213403134041340513406134071340813409134101341113412134131341413415134161341713418134191342013421134221342313424134251342613427134281342913430134311343213433134341343513436134371343813439134401344113442134431344413445134461344713448134491345013451134521345313454134551345613457134581345913460134611346213463134641346513466134671346813469134701347113472134731347413475134761347713478134791348013481134821348313484134851348613487134881348913490134911349213493134941349513496134971349813499135001350113502135031350413505135061350713508135091351013511135121351313514135151351613517135181351913520135211352213523135241352513526135271352813529135301353113532135331353413535135361353713538135391354013541135421354313544135451354613547135481354913550135511355213553135541355513556135571355813559135601356113562135631356413565135661356713568135691357013571135721357313574135751357613577135781357913580135811358213583135841358513586135871358813589135901359113592135931359413595135961359713598135991360013601136021360313604136051360613607136081360913610136111361213613136141361513616136171361813619136201362113622136231362413625136261362713628136291363013631136321363313634136351363613637136381363913640136411364213643136441364513646136471364813649136501365113652136531365413655136561365713658136591366013661136621366313664136651366613667136681366913670136711367213673136741367513676136771367813679136801368113682136831368413685136861368713688136891369013691136921369313694136951369613697136981369913700137011370213703137041370513706137071370813709137101371113712137131371413715137161371713718137191372013721137221372313724137251372613727137281372913730137311373213733137341373513736137371373813739137401374113742137431374413745137461374713748137491375013751137521375313754137551375613757137581375913760137611376213763137641376513766137671376813769137701377113772137731377413775137761377713778137791378013781137821378313784137851378613787137881378913790137911379213793137941379513796137971379813799138001380113802138031380413805138061380713808138091381013811138121381313814138151381613817138181381913820138211382213823138241382513826138271382813829138301383113832138331383413835138361383713838138391384013841138421384313844138451384613847138481384913850138511385213853138541385513856138571385813859138601386113862138631386413865138661386713868138691387013871138721387313874138751387613877138781387913880138811388213883138841388513886138871388813889138901389113892138931389413895138961389713898138991390013901139021390313904139051390613907139081390913910139111391213913139141391513916139171391813919139201392113922139231392413925139261392713928139291393013931139321393313934139351393613937139381393913940139411394213943139441394513946139471394813949139501395113952139531395413955139561395713958139591396013961139621396313964139651396613967139681396913970139711397213973139741397513976139771397813979139801398113982139831398413985139861398713988139891399013991139921399313994139951399613997139981399914000140011400214003140041400514006140071400814009140101401114012140131401414015140161401714018140191402014021140221402314024140251402614027140281402914030140311403214033140341403514036140371403814039140401404114042140431404414045140461404714048140491405014051140521405314054140551405614057140581405914060140611406214063140641406514066140671406814069140701407114072140731407414075140761407714078140791408014081140821408314084140851408614087140881408914090140911409214093140941409514096140971409814099141001410114102141031410414105141061410714108141091411014111141121411314114141151411614117141181411914120141211412214123141241412514126141271412814129141301413114132141331413414135141361413714138141391414014141141421414314144141451414614147141481414914150141511415214153141541415514156141571415814159141601416114162141631416414165141661416714168141691417014171141721417314174141751417614177141781417914180141811418214183141841418514186141871418814189141901419114192141931419414195141961419714198141991420014201142021420314204142051420614207142081420914210142111421214213142141421514216142171421814219142201422114222142231422414225142261422714228142291423014231142321423314234142351423614237142381423914240142411424214243142441424514246142471424814249142501425114252142531425414255142561425714258142591426014261142621426314264142651426614267142681426914270142711427214273142741427514276142771427814279142801428114282142831428414285142861428714288142891429014291142921429314294142951429614297142981429914300143011430214303143041430514306143071430814309143101431114312143131431414315143161431714318143191432014321143221432314324143251432614327143281432914330143311433214333143341433514336143371433814339143401434114342143431434414345143461434714348143491435014351143521435314354143551435614357143581435914360143611436214363143641436514366143671436814369143701437114372143731437414375143761437714378143791438014381143821438314384143851438614387143881438914390143911439214393143941439514396143971439814399144001440114402144031440414405144061440714408144091441014411144121441314414144151441614417144181441914420144211442214423144241442514426144271442814429144301443114432144331443414435144361443714438144391444014441144421444314444144451444614447144481444914450144511445214453144541445514456144571445814459144601446114462144631446414465144661446714468144691447014471144721447314474144751447614477144781447914480144811448214483144841448514486144871448814489144901449114492144931449414495144961449714498144991450014501145021450314504145051450614507145081450914510145111451214513145141451514516145171451814519145201452114522145231452414525145261452714528145291453014531145321453314534145351453614537145381453914540145411454214543145441454514546145471454814549145501455114552145531455414555145561455714558145591456014561145621456314564145651456614567145681456914570145711457214573145741457514576145771457814579145801458114582145831458414585145861458714588145891459014591145921459314594145951459614597145981459914600146011460214603146041460514606146071460814609146101461114612146131461414615146161461714618146191462014621146221462314624146251462614627146281462914630146311463214633146341463514636146371463814639146401464114642146431464414645146461464714648146491465014651146521465314654146551465614657146581465914660146611466214663146641466514666146671466814669146701467114672146731467414675146761467714678146791468014681146821468314684146851468614687146881468914690146911469214693146941469514696146971469814699147001470114702147031470414705147061470714708147091471014711147121471314714147151471614717147181471914720147211472214723147241472514726147271472814729147301473114732147331473414735147361473714738147391474014741147421474314744147451474614747147481474914750147511475214753147541475514756147571475814759147601476114762147631476414765147661476714768147691477014771147721477314774147751477614777147781477914780147811478214783147841478514786147871478814789147901479114792147931479414795147961479714798147991480014801148021480314804148051480614807148081480914810148111481214813148141481514816148171481814819148201482114822148231482414825148261482714828148291483014831148321483314834148351483614837148381483914840148411484214843148441484514846148471484814849148501485114852148531485414855148561485714858148591486014861148621486314864148651486614867148681486914870148711487214873148741487514876148771487814879148801488114882148831488414885148861488714888148891489014891148921489314894148951489614897148981489914900149011490214903149041490514906149071490814909149101491114912149131491414915149161491714918149191492014921149221492314924149251492614927149281492914930149311493214933149341493514936149371493814939149401494114942149431494414945149461494714948149491495014951149521495314954149551495614957149581495914960149611496214963149641496514966149671496814969149701497114972149731497414975149761497714978149791498014981149821498314984149851498614987149881498914990149911499214993149941499514996149971499814999150001500115002150031500415005150061500715008150091501015011150121501315014150151501615017150181501915020150211502215023150241502515026150271502815029150301503115032150331503415035150361503715038150391504015041150421504315044150451504615047150481504915050150511505215053150541505515056150571505815059150601506115062150631506415065150661506715068150691507015071150721507315074150751507615077150781507915080150811508215083150841508515086150871508815089150901509115092150931509415095150961509715098150991510015101151021510315104151051510615107151081510915110151111511215113151141511515116151171511815119151201512115122151231512415125151261512715128151291513015131151321513315134151351513615137151381513915140151411514215143151441514515146151471514815149151501515115152151531515415155151561515715158151591516015161151621516315164151651516615167151681516915170151711517215173151741517515176151771517815179151801518115182151831518415185151861518715188151891519015191151921519315194151951519615197151981519915200152011520215203152041520515206152071520815209152101521115212152131521415215152161521715218152191522015221152221522315224152251522615227152281522915230152311523215233152341523515236152371523815239152401524115242152431524415245152461524715248152491525015251152521525315254152551525615257152581525915260152611526215263152641526515266152671526815269152701527115272152731527415275152761527715278152791528015281152821528315284152851528615287152881528915290152911529215293152941529515296152971529815299153001530115302153031530415305153061530715308153091531015311153121531315314153151531615317153181531915320153211532215323153241532515326153271532815329153301533115332153331533415335153361533715338153391534015341153421534315344153451534615347153481534915350153511535215353153541535515356153571535815359153601536115362153631536415365153661536715368153691537015371153721537315374153751537615377153781537915380153811538215383153841538515386153871538815389153901539115392153931539415395153961539715398153991540015401154021540315404154051540615407154081540915410154111541215413154141541515416154171541815419154201542115422154231542415425154261542715428154291543015431154321543315434154351543615437154381543915440154411544215443154441544515446154471544815449154501545115452154531545415455154561545715458154591546015461154621546315464154651546615467154681546915470154711547215473154741547515476154771547815479154801548115482154831548415485154861548715488154891549015491154921549315494154951549615497154981549915500155011550215503155041550515506155071550815509155101551115512155131551415515155161551715518155191552015521155221552315524155251552615527155281552915530155311553215533155341553515536155371553815539155401554115542155431554415545155461554715548155491555015551155521555315554155551555615557155581555915560155611556215563155641556515566155671556815569155701557115572155731557415575155761557715578155791558015581155821558315584155851558615587155881558915590155911559215593155941559515596155971559815599156001560115602156031560415605156061560715608156091561015611156121561315614156151561615617156181561915620156211562215623156241562515626156271562815629156301563115632156331563415635156361563715638156391564015641156421564315644156451564615647156481564915650156511565215653156541565515656156571565815659156601566115662156631566415665156661566715668156691567015671156721567315674156751567615677156781567915680156811568215683156841568515686156871568815689156901569115692156931569415695156961569715698156991570015701157021570315704157051570615707157081570915710157111571215713157141571515716157171571815719157201572115722157231572415725157261572715728157291573015731157321573315734157351573615737157381573915740157411574215743157441574515746157471574815749157501575115752157531575415755157561575715758157591576015761157621576315764157651576615767157681576915770157711577215773157741577515776157771577815779157801578115782157831578415785157861578715788157891579015791157921579315794157951579615797157981579915800158011580215803158041580515806158071580815809158101581115812158131581415815158161581715818158191582015821158221582315824158251582615827158281582915830158311583215833158341583515836158371583815839158401584115842158431584415845158461584715848158491585015851158521585315854158551585615857158581585915860158611586215863158641586515866158671586815869158701587115872158731587415875158761587715878158791588015881158821588315884158851588615887158881588915890158911589215893158941589515896158971589815899159001590115902159031590415905159061590715908159091591015911159121591315914159151591615917159181591915920159211592215923159241592515926159271592815929159301593115932159331593415935159361593715938159391594015941159421594315944159451594615947159481594915950159511595215953159541595515956159571595815959159601596115962159631596415965159661596715968159691597015971159721597315974159751597615977159781597915980159811598215983159841598515986159871598815989159901599115992159931599415995159961599715998159991600016001160021600316004160051600616007160081600916010160111601216013160141601516016160171601816019160201602116022160231602416025160261602716028160291603016031160321603316034160351603616037160381603916040160411604216043160441604516046160471604816049160501605116052160531605416055160561605716058160591606016061160621606316064160651606616067160681606916070160711607216073160741607516076160771607816079160801608116082160831608416085160861608716088160891609016091160921609316094160951609616097160981609916100161011610216103161041610516106161071610816109161101611116112161131611416115161161611716118161191612016121161221612316124161251612616127161281612916130161311613216133161341613516136161371613816139161401614116142161431614416145161461614716148161491615016151161521615316154161551615616157161581615916160161611616216163161641616516166161671616816169161701617116172161731617416175161761617716178161791618016181161821618316184161851618616187161881618916190161911619216193161941619516196161971619816199162001620116202162031620416205162061620716208162091621016211162121621316214162151621616217162181621916220162211622216223162241622516226162271622816229162301623116232162331623416235162361623716238162391624016241162421624316244162451624616247162481624916250162511625216253162541625516256162571625816259162601626116262162631626416265162661626716268162691627016271162721627316274162751627616277162781627916280162811628216283162841628516286162871628816289162901629116292162931629416295162961629716298162991630016301163021630316304163051630616307163081630916310163111631216313163141631516316163171631816319163201632116322163231632416325163261632716328163291633016331163321633316334163351633616337163381633916340163411634216343163441634516346163471634816349163501635116352163531635416355163561635716358163591636016361163621636316364163651636616367163681636916370163711637216373163741637516376163771637816379163801638116382163831638416385163861638716388163891639016391163921639316394163951639616397163981639916400164011640216403164041640516406164071640816409164101641116412164131641416415164161641716418164191642016421164221642316424164251642616427164281642916430164311643216433164341643516436164371643816439164401644116442164431644416445164461644716448164491645016451164521645316454164551645616457164581645916460164611646216463164641646516466164671646816469164701647116472164731647416475164761647716478164791648016481164821648316484164851648616487164881648916490164911649216493164941649516496164971649816499165001650116502165031650416505165061650716508165091651016511165121651316514165151651616517165181651916520165211652216523165241652516526165271652816529165301653116532165331653416535165361653716538165391654016541165421654316544165451654616547165481654916550165511655216553165541655516556165571655816559165601656116562165631656416565165661656716568165691657016571165721657316574165751657616577165781657916580165811658216583165841658516586165871658816589165901659116592165931659416595165961659716598165991660016601166021660316604166051660616607166081660916610166111661216613166141661516616166171661816619166201662116622166231662416625166261662716628166291663016631166321663316634166351663616637166381663916640166411664216643166441664516646166471664816649166501665116652166531665416655166561665716658166591666016661166621666316664166651666616667166681666916670166711667216673166741667516676166771667816679166801668116682166831668416685166861668716688166891669016691166921669316694166951669616697166981669916700167011670216703167041670516706167071670816709167101671116712167131671416715167161671716718167191672016721167221672316724167251672616727167281672916730167311673216733167341673516736167371673816739167401674116742167431674416745167461674716748167491675016751167521675316754167551675616757167581675916760167611676216763167641676516766167671676816769167701677116772167731677416775167761677716778167791678016781167821678316784167851678616787167881678916790167911679216793167941679516796167971679816799168001680116802168031680416805168061680716808168091681016811168121681316814168151681616817168181681916820168211682216823168241682516826168271682816829168301683116832168331683416835168361683716838168391684016841168421684316844168451684616847168481684916850168511685216853168541685516856168571685816859168601686116862168631686416865168661686716868168691687016871168721687316874168751687616877168781687916880168811688216883168841688516886168871688816889168901689116892168931689416895168961689716898168991690016901169021690316904169051690616907169081690916910169111691216913169141691516916169171691816919169201692116922169231692416925169261692716928169291693016931169321693316934169351693616937169381693916940169411694216943169441694516946169471694816949169501695116952169531695416955169561695716958169591696016961169621696316964169651696616967169681696916970169711697216973169741697516976169771697816979169801698116982169831698416985169861698716988169891699016991169921699316994169951699616997169981699917000170011700217003170041700517006170071700817009170101701117012170131701417015170161701717018170191702017021170221702317024170251702617027170281702917030170311703217033170341703517036170371703817039170401704117042170431704417045170461704717048170491705017051170521705317054170551705617057170581705917060170611706217063170641706517066170671706817069170701707117072170731707417075170761707717078170791708017081170821708317084170851708617087170881708917090170911709217093170941709517096170971709817099171001710117102171031710417105171061710717108171091711017111171121711317114171151711617117171181711917120171211712217123171241712517126171271712817129171301713117132171331713417135171361713717138171391714017141171421714317144171451714617147171481714917150171511715217153171541715517156171571715817159171601716117162171631716417165171661716717168171691717017171171721717317174171751717617177171781717917180171811718217183171841718517186171871718817189171901719117192171931719417195171961719717198171991720017201172021720317204172051720617207172081720917210172111721217213172141721517216172171721817219172201722117222172231722417225172261722717228172291723017231172321723317234172351723617237172381723917240172411724217243172441724517246172471724817249172501725117252172531725417255172561725717258172591726017261172621726317264172651726617267172681726917270172711727217273172741727517276172771727817279172801728117282172831728417285172861728717288172891729017291172921729317294172951729617297172981729917300173011730217303173041730517306173071730817309173101731117312173131731417315173161731717318173191732017321173221732317324173251732617327173281732917330173311733217333173341733517336173371733817339173401734117342173431734417345173461734717348173491735017351173521735317354173551735617357173581735917360173611736217363173641736517366173671736817369173701737117372173731737417375173761737717378173791738017381173821738317384173851738617387173881738917390173911739217393173941739517396173971739817399174001740117402174031740417405174061740717408174091741017411174121741317414174151741617417174181741917420174211742217423174241742517426174271742817429174301743117432174331743417435174361743717438174391744017441174421744317444174451744617447174481744917450174511745217453174541745517456174571745817459174601746117462174631746417465174661746717468174691747017471174721747317474174751747617477174781747917480174811748217483174841748517486174871748817489174901749117492174931749417495174961749717498174991750017501175021750317504175051750617507175081750917510175111751217513175141751517516175171751817519175201752117522175231752417525175261752717528175291753017531175321753317534175351753617537175381753917540175411754217543175441754517546175471754817549175501755117552175531755417555175561755717558175591756017561175621756317564175651756617567175681756917570175711757217573175741757517576175771757817579175801758117582175831758417585175861758717588175891759017591175921759317594175951759617597175981759917600176011760217603176041760517606176071760817609176101761117612176131761417615176161761717618176191762017621176221762317624176251762617627176281762917630176311763217633176341763517636176371763817639176401764117642176431764417645176461764717648176491765017651176521765317654176551765617657176581765917660176611766217663176641766517666176671766817669176701767117672176731767417675176761767717678176791768017681176821768317684176851768617687176881768917690176911769217693176941769517696176971769817699177001770117702177031770417705177061770717708177091771017711177121771317714177151771617717177181771917720177211772217723177241772517726177271772817729177301773117732177331773417735177361773717738177391774017741177421774317744177451774617747177481774917750177511775217753177541775517756177571775817759177601776117762177631776417765177661776717768177691777017771177721777317774177751777617777177781777917780177811778217783177841778517786177871778817789177901779117792177931779417795177961779717798177991780017801178021780317804178051780617807178081780917810178111781217813178141781517816178171781817819178201782117822178231782417825178261782717828178291783017831178321783317834178351783617837178381783917840178411784217843178441784517846178471784817849178501785117852178531785417855178561785717858178591786017861178621786317864178651786617867178681786917870178711787217873178741787517876178771787817879178801788117882178831788417885178861788717888178891789017891178921789317894178951789617897178981789917900179011790217903179041790517906179071790817909179101791117912179131791417915179161791717918179191792017921179221792317924179251792617927179281792917930179311793217933179341793517936179371793817939179401794117942179431794417945179461794717948179491795017951179521795317954179551795617957179581795917960179611796217963179641796517966179671796817969179701797117972179731797417975179761797717978179791798017981179821798317984179851798617987179881798917990179911799217993179941799517996179971799817999180001800118002180031800418005180061800718008180091801018011180121801318014180151801618017180181801918020180211802218023180241802518026180271802818029180301803118032180331803418035180361803718038180391804018041180421804318044180451804618047180481804918050180511805218053180541805518056180571805818059180601806118062180631806418065180661806718068180691807018071180721807318074180751807618077180781807918080180811808218083180841808518086180871808818089180901809118092180931809418095180961809718098180991810018101181021810318104181051810618107181081810918110181111811218113181141811518116181171811818119181201812118122181231812418125181261812718128181291813018131181321813318134181351813618137181381813918140181411814218143181441814518146181471814818149181501815118152181531815418155181561815718158181591816018161181621816318164181651816618167181681816918170181711817218173181741817518176181771817818179181801818118182181831818418185181861818718188181891819018191181921819318194181951819618197181981819918200182011820218203182041820518206182071820818209182101821118212182131821418215182161821718218182191822018221182221822318224182251822618227182281822918230182311823218233182341823518236182371823818239182401824118242182431824418245182461824718248182491825018251182521825318254182551825618257182581825918260182611826218263182641826518266182671826818269182701827118272182731827418275182761827718278182791828018281182821828318284182851828618287182881828918290182911829218293182941829518296182971829818299183001830118302183031830418305183061830718308183091831018311183121831318314183151831618317183181831918320183211832218323183241832518326183271832818329183301833118332183331833418335183361833718338183391834018341183421834318344183451834618347183481834918350183511835218353183541835518356183571835818359183601836118362183631836418365183661836718368183691837018371183721837318374183751837618377183781837918380183811838218383183841838518386183871838818389183901839118392183931839418395183961839718398183991840018401184021840318404184051840618407184081840918410184111841218413184141841518416184171841818419184201842118422184231842418425184261842718428184291843018431184321843318434184351843618437184381843918440184411844218443184441844518446184471844818449184501845118452184531845418455184561845718458184591846018461184621846318464184651846618467184681846918470184711847218473184741847518476184771847818479184801848118482184831848418485184861848718488184891849018491184921849318494184951849618497184981849918500185011850218503185041850518506185071850818509185101851118512185131851418515185161851718518185191852018521185221852318524185251852618527185281852918530185311853218533185341853518536185371853818539185401854118542185431854418545185461854718548185491855018551185521855318554185551855618557185581855918560185611856218563185641856518566185671856818569185701857118572185731857418575185761857718578185791858018581185821858318584185851858618587185881858918590185911859218593185941859518596185971859818599186001860118602186031860418605186061860718608186091861018611186121861318614186151861618617186181861918620186211862218623186241862518626186271862818629186301863118632186331863418635186361863718638186391864018641186421864318644186451864618647186481864918650186511865218653186541865518656186571865818659186601866118662186631866418665186661866718668186691867018671186721867318674186751867618677186781867918680186811868218683186841868518686186871868818689186901869118692186931869418695186961869718698186991870018701187021870318704187051870618707187081870918710187111871218713187141871518716187171871818719187201872118722187231872418725187261872718728187291873018731187321873318734187351873618737187381873918740187411874218743187441874518746187471874818749187501875118752187531875418755187561875718758187591876018761187621876318764187651876618767187681876918770187711877218773187741877518776187771877818779187801878118782187831878418785187861878718788187891879018791187921879318794187951879618797187981879918800188011880218803188041880518806188071880818809188101881118812188131881418815188161881718818188191882018821188221882318824188251882618827188281882918830188311883218833188341883518836188371883818839188401884118842188431884418845188461884718848188491885018851188521885318854188551885618857188581885918860188611886218863188641886518866188671886818869188701887118872188731887418875188761887718878188791888018881188821888318884188851888618887188881888918890188911889218893188941889518896188971889818899189001890118902189031890418905189061890718908189091891018911189121891318914189151891618917189181891918920189211892218923189241892518926189271892818929189301893118932189331893418935189361893718938189391894018941189421894318944189451894618947189481894918950189511895218953189541895518956189571895818959189601896118962189631896418965189661896718968189691897018971189721897318974189751897618977189781897918980189811898218983189841898518986189871898818989189901899118992189931899418995189961899718998189991900019001190021900319004190051900619007190081900919010190111901219013190141901519016190171901819019190201902119022190231902419025190261902719028190291903019031190321903319034190351903619037190381903919040190411904219043190441904519046190471904819049190501905119052190531905419055190561905719058190591906019061190621906319064190651906619067190681906919070190711907219073190741907519076190771907819079190801908119082190831908419085190861908719088190891909019091190921909319094190951909619097190981909919100191011910219103191041910519106191071910819109191101911119112191131911419115191161911719118191191912019121191221912319124191251912619127191281912919130191311913219133191341913519136191371913819139191401914119142191431914419145191461914719148191491915019151191521915319154191551915619157191581915919160191611916219163191641916519166191671916819169191701917119172191731917419175191761917719178191791918019181191821918319184191851918619187191881918919190191911919219193191941919519196191971919819199192001920119202192031920419205192061920719208192091921019211192121921319214192151921619217192181921919220192211922219223192241922519226192271922819229192301923119232192331923419235192361923719238192391924019241192421924319244192451924619247192481924919250192511925219253192541925519256192571925819259192601926119262192631926419265192661926719268192691927019271192721927319274192751927619277192781927919280192811928219283192841928519286192871928819289192901929119292192931929419295192961929719298192991930019301193021930319304193051930619307193081930919310193111931219313193141931519316193171931819319193201932119322193231932419325193261932719328193291933019331193321933319334193351933619337193381933919340193411934219343193441934519346193471934819349193501935119352193531935419355193561935719358193591936019361193621936319364193651936619367193681936919370193711937219373193741937519376193771937819379193801938119382193831938419385193861938719388193891939019391193921939319394193951939619397193981939919400194011940219403194041940519406194071940819409194101941119412194131941419415194161941719418194191942019421194221942319424194251942619427194281942919430194311943219433194341943519436194371943819439194401944119442194431944419445194461944719448194491945019451194521945319454194551945619457194581945919460194611946219463194641946519466194671946819469194701947119472194731947419475194761947719478194791948019481194821948319484194851948619487194881948919490194911949219493194941949519496194971949819499195001950119502195031950419505195061950719508195091951019511195121951319514195151951619517195181951919520195211952219523195241952519526195271952819529195301953119532195331953419535195361953719538195391954019541195421954319544195451954619547195481954919550195511955219553195541955519556195571955819559195601956119562195631956419565195661956719568195691957019571195721957319574195751957619577195781957919580195811958219583195841958519586195871958819589195901959119592195931959419595195961959719598195991960019601196021960319604196051960619607196081960919610196111961219613196141961519616196171961819619196201962119622196231962419625196261962719628196291963019631196321963319634196351963619637196381963919640196411964219643196441964519646196471964819649196501965119652196531965419655196561965719658196591966019661196621966319664196651966619667196681966919670196711967219673196741967519676196771967819679196801968119682196831968419685196861968719688196891969019691196921969319694196951969619697196981969919700197011970219703197041970519706197071970819709197101971119712197131971419715197161971719718197191972019721197221972319724197251972619727197281972919730197311973219733197341973519736197371973819739197401974119742197431974419745197461974719748197491975019751197521975319754197551975619757197581975919760197611976219763197641976519766197671976819769197701977119772197731977419775197761977719778197791978019781197821978319784197851978619787197881978919790197911979219793197941979519796197971979819799198001980119802198031980419805198061980719808198091981019811198121981319814198151981619817198181981919820198211982219823198241982519826198271982819829198301983119832198331983419835198361983719838198391984019841198421984319844198451984619847198481984919850198511985219853198541985519856198571985819859198601986119862198631986419865198661986719868198691987019871198721987319874198751987619877198781987919880198811988219883198841988519886198871988819889198901989119892198931989419895198961989719898198991990019901199021990319904199051990619907199081990919910199111991219913199141991519916199171991819919199201992119922199231992419925199261992719928199291993019931199321993319934199351993619937199381993919940199411994219943199441994519946199471994819949199501995119952199531995419955199561995719958199591996019961199621996319964199651996619967199681996919970199711997219973199741997519976199771997819979199801998119982199831998419985199861998719988199891999019991199921999319994199951999619997199981999920000200012000220003200042000520006200072000820009200102001120012200132001420015200162001720018200192002020021200222002320024200252002620027200282002920030200312003220033200342003520036200372003820039200402004120042200432004420045200462004720048200492005020051200522005320054200552005620057200582005920060200612006220063200642006520066200672006820069200702007120072200732007420075200762007720078200792008020081200822008320084200852008620087200882008920090200912009220093200942009520096200972009820099201002010120102201032010420105201062010720108201092011020111201122011320114201152011620117201182011920120201212012220123201242012520126201272012820129201302013120132201332013420135201362013720138201392014020141201422014320144201452014620147201482014920150201512015220153201542015520156201572015820159201602016120162201632016420165201662016720168201692017020171201722017320174201752017620177201782017920180201812018220183201842018520186201872018820189201902019120192201932019420195201962019720198201992020020201202022020320204202052020620207202082020920210202112021220213202142021520216202172021820219202202022120222202232022420225202262022720228202292023020231202322023320234202352023620237202382023920240202412024220243202442024520246202472024820249202502025120252202532025420255202562025720258202592026020261202622026320264202652026620267202682026920270202712027220273202742027520276202772027820279202802028120282202832028420285202862028720288202892029020291202922029320294202952029620297202982029920300203012030220303203042030520306203072030820309203102031120312203132031420315203162031720318203192032020321203222032320324203252032620327203282032920330203312033220333203342033520336203372033820339203402034120342203432034420345203462034720348203492035020351203522035320354203552035620357203582035920360203612036220363203642036520366203672036820369203702037120372203732037420375203762037720378203792038020381203822038320384203852038620387203882038920390203912039220393203942039520396203972039820399204002040120402204032040420405204062040720408204092041020411204122041320414204152041620417204182041920420204212042220423204242042520426204272042820429204302043120432204332043420435204362043720438204392044020441204422044320444204452044620447204482044920450204512045220453204542045520456204572045820459204602046120462204632046420465204662046720468204692047020471204722047320474204752047620477204782047920480204812048220483204842048520486204872048820489204902049120492204932049420495204962049720498204992050020501205022050320504205052050620507205082050920510205112051220513205142051520516205172051820519205202052120522205232052420525205262052720528205292053020531205322053320534205352053620537205382053920540205412054220543205442054520546205472054820549205502055120552205532055420555205562055720558205592056020561205622056320564205652056620567205682056920570205712057220573205742057520576205772057820579205802058120582205832058420585205862058720588205892059020591205922059320594205952059620597205982059920600206012060220603206042060520606206072060820609206102061120612206132061420615206162061720618206192062020621206222062320624206252062620627206282062920630206312063220633206342063520636206372063820639206402064120642206432064420645206462064720648206492065020651206522065320654206552065620657206582065920660206612066220663206642066520666206672066820669206702067120672206732067420675206762067720678206792068020681206822068320684206852068620687206882068920690206912069220693206942069520696206972069820699207002070120702207032070420705207062070720708207092071020711207122071320714207152071620717207182071920720207212072220723207242072520726207272072820729207302073120732207332073420735207362073720738207392074020741207422074320744207452074620747207482074920750207512075220753207542075520756207572075820759207602076120762207632076420765207662076720768207692077020771207722077320774207752077620777207782077920780207812078220783207842078520786207872078820789207902079120792207932079420795207962079720798207992080020801208022080320804208052080620807208082080920810208112081220813208142081520816208172081820819208202082120822208232082420825208262082720828208292083020831208322083320834208352083620837208382083920840208412084220843208442084520846208472084820849208502085120852208532085420855208562085720858208592086020861208622086320864208652086620867208682086920870208712087220873208742087520876208772087820879208802088120882208832088420885208862088720888208892089020891208922089320894208952089620897208982089920900209012090220903209042090520906209072090820909209102091120912209132091420915209162091720918209192092020921209222092320924209252092620927209282092920930209312093220933209342093520936209372093820939209402094120942209432094420945209462094720948209492095020951209522095320954209552095620957209582095920960209612096220963209642096520966209672096820969209702097120972209732097420975209762097720978209792098020981209822098320984209852098620987209882098920990209912099220993209942099520996209972099820999210002100121002210032100421005210062100721008210092101021011210122101321014210152101621017210182101921020210212102221023210242102521026210272102821029210302103121032210332103421035210362103721038210392104021041210422104321044210452104621047210482104921050210512105221053210542105521056210572105821059210602106121062210632106421065210662106721068210692107021071210722107321074210752107621077210782107921080210812108221083210842108521086210872108821089210902109121092210932109421095210962109721098210992110021101211022110321104211052110621107211082110921110211112111221113211142111521116211172111821119211202112121122211232112421125211262112721128211292113021131211322113321134211352113621137211382113921140211412114221143211442114521146211472114821149211502115121152211532115421155211562115721158211592116021161211622116321164211652116621167211682116921170211712117221173211742117521176211772117821179211802118121182211832118421185211862118721188211892119021191211922119321194211952119621197211982119921200212012120221203212042120521206212072120821209212102121121212212132121421215212162121721218212192122021221212222122321224212252122621227212282122921230212312123221233212342123521236212372123821239212402124121242212432124421245212462124721248212492125021251212522125321254212552125621257212582125921260212612126221263212642126521266212672126821269212702127121272212732127421275212762127721278212792128021281212822128321284212852128621287212882128921290212912129221293212942129521296212972129821299213002130121302213032130421305213062130721308213092131021311213122131321314213152131621317213182131921320213212132221323213242132521326213272132821329213302133121332213332133421335213362133721338213392134021341213422134321344213452134621347213482134921350213512135221353213542135521356213572135821359213602136121362213632136421365213662136721368213692137021371213722137321374213752137621377213782137921380213812138221383213842138521386213872138821389213902139121392213932139421395213962139721398213992140021401214022140321404214052140621407214082140921410214112141221413214142141521416214172141821419214202142121422214232142421425214262142721428214292143021431214322143321434214352143621437214382143921440214412144221443214442144521446214472144821449214502145121452214532145421455214562145721458214592146021461214622146321464214652146621467214682146921470214712147221473214742147521476214772147821479214802148121482214832148421485214862148721488214892149021491214922149321494214952149621497214982149921500215012150221503215042150521506215072150821509215102151121512215132151421515215162151721518215192152021521215222152321524215252152621527215282152921530215312153221533215342153521536215372153821539215402154121542215432154421545215462154721548215492155021551215522155321554215552155621557215582155921560215612156221563215642156521566215672156821569215702157121572215732157421575215762157721578215792158021581215822158321584215852158621587215882158921590215912159221593215942159521596215972159821599216002160121602216032160421605216062160721608216092161021611216122161321614216152161621617216182161921620216212162221623216242162521626216272162821629216302163121632216332163421635216362163721638216392164021641216422164321644216452164621647216482164921650216512165221653216542165521656216572165821659216602166121662216632166421665216662166721668216692167021671216722167321674216752167621677216782167921680216812168221683216842168521686216872168821689216902169121692216932169421695216962169721698216992170021701217022170321704217052170621707217082170921710217112171221713217142171521716217172171821719217202172121722217232172421725217262172721728217292173021731217322173321734217352173621737217382173921740217412174221743217442174521746217472174821749217502175121752217532175421755217562175721758217592176021761217622176321764217652176621767217682176921770217712177221773217742177521776217772177821779217802178121782217832178421785217862178721788217892179021791217922179321794217952179621797217982179921800218012180221803218042180521806218072180821809218102181121812218132181421815218162181721818218192182021821218222182321824218252182621827218282182921830218312183221833218342183521836218372183821839218402184121842218432184421845218462184721848218492185021851218522185321854218552185621857218582185921860218612186221863218642186521866218672186821869218702187121872218732187421875218762187721878218792188021881218822188321884218852188621887218882188921890218912189221893218942189521896218972189821899219002190121902219032190421905219062190721908219092191021911219122191321914219152191621917219182191921920219212192221923219242192521926219272192821929219302193121932219332193421935219362193721938219392194021941219422194321944219452194621947219482194921950219512195221953219542195521956219572195821959219602196121962219632196421965219662196721968219692197021971219722197321974219752197621977219782197921980219812198221983219842198521986219872198821989219902199121992219932199421995219962199721998219992200022001220022200322004220052200622007220082200922010220112201222013220142201522016220172201822019220202202122022220232202422025220262202722028220292203022031220322203322034220352203622037220382203922040220412204222043220442204522046220472204822049220502205122052220532205422055220562205722058220592206022061220622206322064220652206622067220682206922070220712207222073220742207522076220772207822079220802208122082220832208422085220862208722088220892209022091220922209322094220952209622097220982209922100221012210222103221042210522106221072210822109221102211122112221132211422115221162211722118221192212022121221222212322124221252212622127221282212922130221312213222133221342213522136221372213822139221402214122142221432214422145221462214722148221492215022151221522215322154221552215622157221582215922160221612216222163221642216522166221672216822169221702217122172221732217422175221762217722178221792218022181221822218322184221852218622187221882218922190221912219222193221942219522196221972219822199222002220122202222032220422205222062220722208222092221022211222122221322214222152221622217222182221922220222212222222223222242222522226222272222822229222302223122232222332223422235222362223722238222392224022241222422224322244222452224622247222482224922250222512225222253222542225522256222572225822259222602226122262222632226422265222662226722268222692227022271222722227322274222752227622277222782227922280222812228222283222842228522286222872228822289222902229122292222932229422295222962229722298222992230022301223022230322304223052230622307223082230922310223112231222313223142231522316223172231822319223202232122322223232232422325223262232722328223292233022331223322233322334223352233622337223382233922340223412234222343223442234522346223472234822349223502235122352223532235422355223562235722358223592236022361223622236322364223652236622367223682236922370223712237222373223742237522376223772237822379223802238122382223832238422385223862238722388223892239022391223922239322394223952239622397223982239922400224012240222403224042240522406224072240822409224102241122412224132241422415224162241722418224192242022421224222242322424224252242622427224282242922430224312243222433224342243522436224372243822439224402244122442224432244422445224462244722448224492245022451224522245322454224552245622457224582245922460224612246222463224642246522466224672246822469224702247122472224732247422475224762247722478224792248022481224822248322484224852248622487224882248922490224912249222493224942249522496224972249822499225002250122502225032250422505225062250722508225092251022511225122251322514225152251622517225182251922520225212252222523225242252522526225272252822529225302253122532225332253422535225362253722538225392254022541225422254322544225452254622547225482254922550225512255222553225542255522556225572255822559225602256122562225632256422565225662256722568225692257022571225722257322574225752257622577225782257922580225812258222583225842258522586225872258822589225902259122592225932259422595225962259722598225992260022601226022260322604226052260622607226082260922610226112261222613226142261522616226172261822619226202262122622226232262422625226262262722628226292263022631226322263322634226352263622637226382263922640226412264222643226442264522646226472264822649226502265122652226532265422655226562265722658226592266022661226622266322664226652266622667226682266922670226712267222673226742267522676226772267822679226802268122682226832268422685226862268722688226892269022691226922269322694226952269622697226982269922700227012270222703227042270522706227072270822709227102271122712227132271422715227162271722718227192272022721227222272322724227252272622727227282272922730227312273222733227342273522736227372273822739227402274122742227432274422745227462274722748227492275022751227522275322754227552275622757227582275922760227612276222763227642276522766227672276822769227702277122772227732277422775227762277722778227792278022781227822278322784227852278622787227882278922790227912279222793227942279522796227972279822799228002280122802228032280422805228062280722808228092281022811228122281322814228152281622817228182281922820228212282222823228242282522826228272282822829228302283122832228332283422835228362283722838228392284022841228422284322844228452284622847228482284922850228512285222853228542285522856228572285822859228602286122862228632286422865228662286722868228692287022871228722287322874228752287622877228782287922880228812288222883228842288522886228872288822889228902289122892228932289422895228962289722898228992290022901229022290322904229052290622907229082290922910229112291222913229142291522916229172291822919229202292122922229232292422925229262292722928229292293022931229322293322934229352293622937229382293922940229412294222943229442294522946229472294822949229502295122952229532295422955229562295722958229592296022961229622296322964229652296622967229682296922970229712297222973229742297522976229772297822979229802298122982229832298422985229862298722988229892299022991229922299322994229952299622997229982299923000230012300223003230042300523006230072300823009230102301123012230132301423015230162301723018230192302023021230222302323024230252302623027230282302923030230312303223033230342303523036230372303823039230402304123042230432304423045230462304723048230492305023051230522305323054230552305623057230582305923060230612306223063230642306523066230672306823069230702307123072230732307423075230762307723078230792308023081230822308323084230852308623087230882308923090230912309223093230942309523096230972309823099231002310123102231032310423105231062310723108231092311023111231122311323114231152311623117231182311923120231212312223123231242312523126231272312823129231302313123132231332313423135231362313723138231392314023141231422314323144231452314623147231482314923150231512315223153231542315523156231572315823159231602316123162231632316423165231662316723168231692317023171231722317323174231752317623177231782317923180231812318223183231842318523186231872318823189231902319123192231932319423195231962319723198231992320023201232022320323204232052320623207232082320923210232112321223213232142321523216232172321823219232202322123222232232322423225232262322723228232292323023231232322323323234232352323623237232382323923240232412324223243232442324523246232472324823249232502325123252232532325423255232562325723258232592326023261232622326323264232652326623267232682326923270232712327223273232742327523276232772327823279232802328123282232832328423285232862328723288232892329023291232922329323294232952329623297232982329923300233012330223303233042330523306233072330823309233102331123312233132331423315233162331723318233192332023321233222332323324233252332623327233282332923330233312333223333233342333523336233372333823339233402334123342233432334423345233462334723348233492335023351233522335323354233552335623357233582335923360233612336223363233642336523366233672336823369233702337123372233732337423375233762337723378233792338023381233822338323384233852338623387233882338923390233912339223393233942339523396233972339823399234002340123402234032340423405234062340723408234092341023411234122341323414234152341623417234182341923420234212342223423234242342523426234272342823429234302343123432234332343423435234362343723438234392344023441234422344323444234452344623447234482344923450234512345223453234542345523456234572345823459234602346123462234632346423465234662346723468234692347023471234722347323474234752347623477234782347923480234812348223483234842348523486234872348823489234902349123492234932349423495234962349723498234992350023501235022350323504235052350623507235082350923510235112351223513235142351523516235172351823519235202352123522235232352423525235262352723528235292353023531235322353323534235352353623537235382353923540235412354223543235442354523546235472354823549235502355123552235532355423555235562355723558235592356023561235622356323564235652356623567235682356923570235712357223573235742357523576235772357823579235802358123582235832358423585235862358723588235892359023591235922359323594235952359623597235982359923600236012360223603236042360523606236072360823609236102361123612236132361423615236162361723618236192362023621236222362323624236252362623627236282362923630236312363223633236342363523636236372363823639236402364123642236432364423645236462364723648236492365023651236522365323654236552365623657236582365923660236612366223663236642366523666236672366823669236702367123672236732367423675236762367723678236792368023681236822368323684236852368623687236882368923690236912369223693236942369523696236972369823699237002370123702237032370423705237062370723708237092371023711237122371323714237152371623717237182371923720237212372223723237242372523726237272372823729237302373123732237332373423735237362373723738237392374023741237422374323744237452374623747237482374923750237512375223753237542375523756237572375823759237602376123762237632376423765237662376723768237692377023771237722377323774237752377623777237782377923780237812378223783237842378523786237872378823789237902379123792237932379423795237962379723798237992380023801238022380323804238052380623807238082380923810238112381223813238142381523816238172381823819238202382123822238232382423825238262382723828238292383023831238322383323834238352383623837238382383923840238412384223843238442384523846238472384823849238502385123852238532385423855238562385723858238592386023861238622386323864238652386623867238682386923870238712387223873238742387523876238772387823879238802388123882238832388423885238862388723888238892389023891238922389323894238952389623897238982389923900239012390223903239042390523906239072390823909239102391123912239132391423915239162391723918239192392023921239222392323924239252392623927239282392923930239312393223933239342393523936239372393823939239402394123942239432394423945239462394723948239492395023951239522395323954239552395623957239582395923960239612396223963239642396523966239672396823969239702397123972239732397423975239762397723978239792398023981239822398323984239852398623987239882398923990239912399223993239942399523996239972399823999240002400124002240032400424005240062400724008240092401024011240122401324014240152401624017240182401924020240212402224023240242402524026240272402824029240302403124032240332403424035240362403724038240392404024041240422404324044240452404624047240482404924050240512405224053240542405524056240572405824059240602406124062240632406424065240662406724068240692407024071240722407324074240752407624077240782407924080240812408224083240842408524086240872408824089240902409124092240932409424095240962409724098240992410024101241022410324104241052410624107241082410924110241112411224113241142411524116241172411824119241202412124122241232412424125241262412724128241292413024131241322413324134241352413624137241382413924140241412414224143241442414524146241472414824149241502415124152241532415424155241562415724158241592416024161241622416324164241652416624167241682416924170241712417224173241742417524176241772417824179241802418124182241832418424185241862418724188241892419024191241922419324194241952419624197241982419924200242012420224203242042420524206242072420824209242102421124212242132421424215242162421724218242192422024221242222422324224242252422624227242282422924230242312423224233242342423524236242372423824239242402424124242242432424424245242462424724248242492425024251242522425324254242552425624257242582425924260242612426224263242642426524266242672426824269242702427124272242732427424275242762427724278242792428024281242822428324284242852428624287242882428924290242912429224293242942429524296242972429824299243002430124302243032430424305243062430724308243092431024311243122431324314243152431624317243182431924320243212432224323243242432524326243272432824329243302433124332243332433424335243362433724338243392434024341243422434324344243452434624347243482434924350243512435224353243542435524356243572435824359243602436124362243632436424365243662436724368243692437024371243722437324374243752437624377243782437924380243812438224383243842438524386243872438824389243902439124392243932439424395243962439724398243992440024401244022440324404244052440624407244082440924410244112441224413244142441524416244172441824419244202442124422244232442424425244262442724428244292443024431244322443324434244352443624437244382443924440244412444224443244442444524446244472444824449244502445124452244532445424455244562445724458244592446024461244622446324464244652446624467244682446924470244712447224473244742447524476244772447824479244802448124482244832448424485244862448724488244892449024491244922449324494244952449624497244982449924500245012450224503245042450524506245072450824509245102451124512245132451424515245162451724518245192452024521245222452324524245252452624527245282452924530245312453224533245342453524536245372453824539245402454124542245432454424545245462454724548245492455024551245522455324554245552455624557245582455924560245612456224563245642456524566245672456824569245702457124572245732457424575245762457724578245792458024581245822458324584245852458624587245882458924590245912459224593245942459524596245972459824599246002460124602246032460424605246062460724608246092461024611246122461324614246152461624617246182461924620246212462224623246242462524626246272462824629246302463124632246332463424635246362463724638246392464024641246422464324644246452464624647246482464924650246512465224653246542465524656246572465824659246602466124662246632466424665246662466724668246692467024671246722467324674246752467624677246782467924680246812468224683246842468524686246872468824689246902469124692246932469424695246962469724698246992470024701247022470324704247052470624707247082470924710247112471224713247142471524716247172471824719247202472124722247232472424725247262472724728247292473024731247322473324734247352473624737247382473924740247412474224743247442474524746247472474824749247502475124752247532475424755247562475724758247592476024761247622476324764247652476624767247682476924770247712477224773247742477524776247772477824779247802478124782247832478424785247862478724788247892479024791247922479324794247952479624797247982479924800248012480224803248042480524806248072480824809248102481124812248132481424815248162481724818248192482024821248222482324824248252482624827248282482924830248312483224833248342483524836248372483824839248402484124842248432484424845248462484724848248492485024851248522485324854248552485624857248582485924860248612486224863248642486524866248672486824869248702487124872248732487424875248762487724878248792488024881248822488324884248852488624887248882488924890248912489224893248942489524896248972489824899249002490124902249032490424905249062490724908249092491024911249122491324914249152491624917249182491924920249212492224923249242492524926249272492824929249302493124932249332493424935249362493724938249392494024941249422494324944249452494624947249482494924950249512495224953249542495524956249572495824959249602496124962249632496424965249662496724968249692497024971249722497324974249752497624977249782497924980249812498224983249842498524986249872498824989249902499124992249932499424995249962499724998249992500025001250022500325004250052500625007250082500925010250112501225013250142501525016250172501825019250202502125022250232502425025250262502725028250292503025031250322503325034250352503625037250382503925040250412504225043250442504525046250472504825049250502505125052250532505425055250562505725058250592506025061250622506325064250652506625067250682506925070250712507225073250742507525076250772507825079250802508125082250832508425085250862508725088250892509025091250922509325094250952509625097250982509925100251012510225103251042510525106251072510825109251102511125112251132511425115251162511725118251192512025121251222512325124251252512625127251282512925130251312513225133251342513525136251372513825139251402514125142251432514425145251462514725148251492515025151251522515325154251552515625157251582515925160251612516225163251642516525166251672516825169251702517125172251732517425175251762517725178251792518025181251822518325184251852518625187251882518925190251912519225193251942519525196251972519825199252002520125202252032520425205252062520725208252092521025211252122521325214252152521625217252182521925220252212522225223252242522525226252272522825229252302523125232252332523425235252362523725238252392524025241252422524325244252452524625247252482524925250252512525225253252542525525256252572525825259252602526125262252632526425265252662526725268252692527025271252722527325274252752527625277252782527925280252812528225283252842528525286252872528825289252902529125292252932529425295252962529725298252992530025301253022530325304253052530625307253082530925310253112531225313253142531525316253172531825319253202532125322253232532425325253262532725328253292533025331253322533325334253352533625337253382533925340253412534225343253442534525346253472534825349253502535125352253532535425355253562535725358253592536025361253622536325364253652536625367253682536925370253712537225373253742537525376253772537825379253802538125382253832538425385253862538725388253892539025391253922539325394253952539625397253982539925400254012540225403254042540525406254072540825409254102541125412254132541425415254162541725418254192542025421254222542325424254252542625427254282542925430254312543225433254342543525436254372543825439254402544125442254432544425445254462544725448254492545025451254522545325454254552545625457254582545925460254612546225463254642546525466254672546825469254702547125472254732547425475254762547725478254792548025481254822548325484254852548625487254882548925490254912549225493254942549525496254972549825499255002550125502255032550425505255062550725508255092551025511255122551325514255152551625517255182551925520255212552225523255242552525526255272552825529255302553125532255332553425535255362553725538255392554025541255422554325544255452554625547255482554925550255512555225553255542555525556255572555825559255602556125562255632556425565255662556725568255692557025571255722557325574255752557625577255782557925580255812558225583255842558525586255872558825589255902559125592255932559425595255962559725598255992560025601256022560325604256052560625607256082560925610256112561225613256142561525616256172561825619256202562125622256232562425625256262562725628256292563025631256322563325634256352563625637256382563925640256412564225643256442564525646256472564825649256502565125652256532565425655256562565725658256592566025661256622566325664256652566625667256682566925670256712567225673256742567525676256772567825679256802568125682256832568425685256862568725688256892569025691256922569325694256952569625697256982569925700257012570225703257042570525706257072570825709257102571125712257132571425715257162571725718257192572025721257222572325724257252572625727257282572925730257312573225733257342573525736257372573825739257402574125742257432574425745257462574725748257492575025751257522575325754257552575625757257582575925760257612576225763257642576525766257672576825769257702577125772257732577425775257762577725778257792578025781257822578325784257852578625787257882578925790257912579225793257942579525796257972579825799258002580125802258032580425805258062580725808258092581025811258122581325814258152581625817258182581925820258212582225823258242582525826258272582825829258302583125832258332583425835258362583725838258392584025841258422584325844258452584625847258482584925850258512585225853258542585525856258572585825859258602586125862258632586425865258662586725868258692587025871258722587325874258752587625877258782587925880258812588225883258842588525886258872588825889258902589125892258932589425895258962589725898258992590025901259022590325904259052590625907259082590925910259112591225913259142591525916259172591825919259202592125922259232592425925259262592725928259292593025931259322593325934259352593625937259382593925940259412594225943259442594525946259472594825949259502595125952259532595425955259562595725958259592596025961259622596325964259652596625967259682596925970259712597225973259742597525976259772597825979259802598125982259832598425985259862598725988259892599025991259922599325994259952599625997259982599926000260012600226003260042600526006260072600826009260102601126012260132601426015260162601726018260192602026021260222602326024260252602626027260282602926030260312603226033260342603526036260372603826039260402604126042260432604426045260462604726048260492605026051260522605326054260552605626057260582605926060260612606226063260642606526066260672606826069260702607126072260732607426075260762607726078260792608026081260822608326084260852608626087260882608926090260912609226093260942609526096260972609826099261002610126102261032610426105261062610726108261092611026111261122611326114261152611626117261182611926120261212612226123261242612526126261272612826129261302613126132261332613426135261362613726138261392614026141261422614326144261452614626147261482614926150261512615226153261542615526156261572615826159261602616126162261632616426165261662616726168261692617026171261722617326174261752617626177261782617926180261812618226183261842618526186261872618826189261902619126192261932619426195261962619726198261992620026201262022620326204262052620626207262082620926210262112621226213262142621526216262172621826219262202622126222262232622426225262262622726228262292623026231262322623326234262352623626237262382623926240262412624226243262442624526246262472624826249262502625126252262532625426255262562625726258262592626026261262622626326264262652626626267262682626926270262712627226273262742627526276262772627826279262802628126282262832628426285262862628726288262892629026291262922629326294262952629626297262982629926300263012630226303263042630526306263072630826309263102631126312263132631426315263162631726318263192632026321263222632326324263252632626327263282632926330263312633226333263342633526336263372633826339263402634126342263432634426345263462634726348263492635026351263522635326354263552635626357263582635926360263612636226363263642636526366263672636826369263702637126372263732637426375263762637726378263792638026381263822638326384263852638626387263882638926390263912639226393263942639526396263972639826399264002640126402264032640426405264062640726408264092641026411264122641326414264152641626417264182641926420264212642226423264242642526426264272642826429264302643126432264332643426435264362643726438264392644026441264422644326444264452644626447264482644926450264512645226453264542645526456264572645826459264602646126462264632646426465264662646726468264692647026471264722647326474264752647626477264782647926480264812648226483264842648526486264872648826489264902649126492264932649426495264962649726498264992650026501265022650326504265052650626507265082650926510265112651226513265142651526516265172651826519265202652126522265232652426525265262652726528265292653026531265322653326534265352653626537265382653926540265412654226543265442654526546265472654826549265502655126552265532655426555265562655726558265592656026561265622656326564265652656626567265682656926570265712657226573265742657526576265772657826579265802658126582265832658426585265862658726588265892659026591265922659326594265952659626597265982659926600266012660226603266042660526606266072660826609266102661126612266132661426615266162661726618266192662026621266222662326624266252662626627266282662926630266312663226633266342663526636266372663826639266402664126642266432664426645266462664726648266492665026651266522665326654266552665626657266582665926660266612666226663266642666526666266672666826669266702667126672266732667426675266762667726678266792668026681266822668326684266852668626687266882668926690266912669226693266942669526696266972669826699267002670126702267032670426705267062670726708267092671026711267122671326714267152671626717267182671926720267212672226723267242672526726267272672826729267302673126732267332673426735267362673726738267392674026741267422674326744267452674626747267482674926750267512675226753267542675526756267572675826759267602676126762267632676426765267662676726768267692677026771267722677326774267752677626777267782677926780267812678226783267842678526786267872678826789267902679126792267932679426795267962679726798267992680026801268022680326804268052680626807268082680926810268112681226813268142681526816268172681826819268202682126822268232682426825268262682726828268292683026831268322683326834268352683626837268382683926840268412684226843268442684526846268472684826849268502685126852268532685426855268562685726858268592686026861268622686326864268652686626867268682686926870268712687226873268742687526876268772687826879268802688126882268832688426885268862688726888268892689026891268922689326894268952689626897268982689926900269012690226903269042690526906269072690826909269102691126912269132691426915269162691726918269192692026921269222692326924269252692626927269282692926930269312693226933269342693526936269372693826939269402694126942269432694426945269462694726948269492695026951269522695326954269552695626957269582695926960269612696226963269642696526966269672696826969269702697126972269732697426975269762697726978269792698026981269822698326984269852698626987269882698926990269912699226993269942699526996269972699826999270002700127002270032700427005270062700727008270092701027011270122701327014270152701627017270182701927020270212702227023270242702527026270272702827029270302703127032270332703427035270362703727038270392704027041270422704327044270452704627047270482704927050270512705227053270542705527056270572705827059270602706127062270632706427065270662706727068270692707027071270722707327074270752707627077270782707927080270812708227083270842708527086270872708827089270902709127092270932709427095270962709727098270992710027101271022710327104271052710627107271082710927110271112711227113271142711527116271172711827119271202712127122271232712427125271262712727128271292713027131271322713327134271352713627137271382713927140271412714227143271442714527146271472714827149271502715127152271532715427155271562715727158271592716027161271622716327164271652716627167271682716927170271712717227173271742717527176271772717827179271802718127182271832718427185271862718727188271892719027191271922719327194271952719627197271982719927200272012720227203272042720527206272072720827209272102721127212272132721427215272162721727218272192722027221272222722327224272252722627227272282722927230272312723227233272342723527236272372723827239272402724127242272432724427245272462724727248272492725027251272522725327254272552725627257272582725927260272612726227263272642726527266272672726827269272702727127272272732727427275272762727727278272792728027281272822728327284272852728627287272882728927290272912729227293272942729527296272972729827299273002730127302273032730427305273062730727308273092731027311273122731327314273152731627317273182731927320273212732227323273242732527326273272732827329273302733127332273332733427335273362733727338273392734027341273422734327344273452734627347273482734927350273512735227353273542735527356273572735827359273602736127362273632736427365273662736727368273692737027371273722737327374273752737627377273782737927380273812738227383273842738527386273872738827389273902739127392273932739427395273962739727398273992740027401274022740327404274052740627407274082740927410274112741227413274142741527416274172741827419274202742127422274232742427425274262742727428274292743027431274322743327434274352743627437274382743927440274412744227443274442744527446274472744827449274502745127452274532745427455274562745727458274592746027461274622746327464274652746627467274682746927470274712747227473274742747527476274772747827479274802748127482274832748427485274862748727488274892749027491274922749327494274952749627497274982749927500275012750227503275042750527506275072750827509275102751127512275132751427515275162751727518275192752027521275222752327524275252752627527275282752927530275312753227533275342753527536275372753827539275402754127542275432754427545275462754727548275492755027551275522755327554275552755627557275582755927560275612756227563275642756527566275672756827569275702757127572275732757427575275762757727578275792758027581275822758327584275852758627587275882758927590275912759227593275942759527596275972759827599276002760127602276032760427605276062760727608276092761027611276122761327614276152761627617276182761927620276212762227623276242762527626276272762827629276302763127632276332763427635276362763727638276392764027641276422764327644276452764627647276482764927650276512765227653276542765527656276572765827659276602766127662276632766427665276662766727668276692767027671276722767327674276752767627677276782767927680276812768227683276842768527686276872768827689276902769127692276932769427695276962769727698276992770027701277022770327704277052770627707277082770927710277112771227713277142771527716277172771827719277202772127722277232772427725277262772727728277292773027731277322773327734277352773627737277382773927740277412774227743277442774527746277472774827749277502775127752277532775427755277562775727758277592776027761277622776327764277652776627767277682776927770277712777227773277742777527776277772777827779277802778127782277832778427785277862778727788277892779027791277922779327794277952779627797277982779927800278012780227803278042780527806278072780827809278102781127812278132781427815278162781727818278192782027821278222782327824278252782627827278282782927830278312783227833278342783527836278372783827839278402784127842278432784427845278462784727848278492785027851278522785327854278552785627857278582785927860278612786227863278642786527866278672786827869278702787127872278732787427875278762787727878278792788027881278822788327884278852788627887278882788927890278912789227893278942789527896278972789827899279002790127902279032790427905279062790727908279092791027911279122791327914279152791627917279182791927920279212792227923279242792527926279272792827929279302793127932279332793427935279362793727938279392794027941279422794327944279452794627947279482794927950279512795227953279542795527956279572795827959279602796127962279632796427965279662796727968279692797027971279722797327974279752797627977279782797927980279812798227983279842798527986279872798827989279902799127992279932799427995279962799727998279992800028001280022800328004280052800628007280082800928010280112801228013280142801528016280172801828019280202802128022280232802428025280262802728028280292803028031280322803328034280352803628037280382803928040280412804228043280442804528046280472804828049280502805128052280532805428055280562805728058280592806028061280622806328064280652806628067280682806928070280712807228073280742807528076280772807828079280802808128082280832808428085280862808728088280892809028091280922809328094280952809628097280982809928100281012810228103281042810528106281072810828109281102811128112281132811428115281162811728118281192812028121281222812328124281252812628127281282812928130281312813228133281342813528136281372813828139281402814128142281432814428145281462814728148281492815028151281522815328154281552815628157281582815928160281612816228163281642816528166281672816828169281702817128172281732817428175281762817728178281792818028181281822818328184281852818628187281882818928190281912819228193281942819528196281972819828199282002820128202282032820428205282062820728208282092821028211282122821328214282152821628217282182821928220282212822228223282242822528226282272822828229282302823128232282332823428235282362823728238282392824028241282422824328244282452824628247282482824928250282512825228253282542825528256282572825828259282602826128262282632826428265282662826728268282692827028271282722827328274282752827628277282782827928280282812828228283282842828528286282872828828289282902829128292282932829428295282962829728298282992830028301283022830328304283052830628307283082830928310283112831228313283142831528316283172831828319283202832128322283232832428325283262832728328283292833028331283322833328334283352833628337283382833928340283412834228343283442834528346283472834828349283502835128352283532835428355283562835728358283592836028361283622836328364283652836628367283682836928370283712837228373283742837528376283772837828379283802838128382283832838428385283862838728388283892839028391283922839328394283952839628397283982839928400284012840228403284042840528406284072840828409284102841128412284132841428415284162841728418284192842028421284222842328424284252842628427284282842928430284312843228433284342843528436284372843828439284402844128442284432844428445284462844728448284492845028451284522845328454284552845628457284582845928460284612846228463284642846528466284672846828469284702847128472284732847428475284762847728478284792848028481284822848328484284852848628487284882848928490284912849228493284942849528496284972849828499285002850128502285032850428505285062850728508285092851028511285122851328514285152851628517285182851928520285212852228523285242852528526285272852828529285302853128532285332853428535285362853728538285392854028541285422854328544285452854628547285482854928550285512855228553285542855528556285572855828559285602856128562285632856428565285662856728568285692857028571285722857328574285752857628577285782857928580285812858228583285842858528586285872858828589285902859128592285932859428595285962859728598285992860028601286022860328604286052860628607286082860928610286112861228613286142861528616286172861828619286202862128622286232862428625286262862728628286292863028631286322863328634286352863628637286382863928640286412864228643286442864528646286472864828649286502865128652286532865428655286562865728658286592866028661286622866328664286652866628667286682866928670286712867228673286742867528676286772867828679286802868128682286832868428685286862868728688286892869028691286922869328694286952869628697286982869928700287012870228703287042870528706287072870828709287102871128712287132871428715287162871728718287192872028721287222872328724287252872628727287282872928730287312873228733287342873528736287372873828739287402874128742287432874428745287462874728748287492875028751287522875328754287552875628757287582875928760287612876228763287642876528766287672876828769287702877128772287732877428775287762877728778287792878028781287822878328784287852878628787287882878928790287912879228793287942879528796287972879828799288002880128802288032880428805288062880728808288092881028811288122881328814288152881628817288182881928820288212882228823288242882528826288272882828829288302883128832288332883428835288362883728838288392884028841288422884328844288452884628847288482884928850288512885228853288542885528856288572885828859288602886128862288632886428865288662886728868288692887028871288722887328874288752887628877288782887928880288812888228883288842888528886288872888828889288902889128892288932889428895288962889728898288992890028901289022890328904289052890628907289082890928910289112891228913289142891528916289172891828919289202892128922289232892428925289262892728928289292893028931289322893328934289352893628937289382893928940289412894228943289442894528946289472894828949289502895128952289532895428955289562895728958289592896028961289622896328964289652896628967289682896928970289712897228973289742897528976289772897828979289802898128982289832898428985289862898728988289892899028991289922899328994289952899628997289982899929000290012900229003290042900529006290072900829009290102901129012290132901429015290162901729018290192902029021290222902329024290252902629027290282902929030290312903229033290342903529036290372903829039290402904129042290432904429045290462904729048290492905029051290522905329054290552905629057290582905929060290612906229063290642906529066290672906829069290702907129072290732907429075290762907729078290792908029081290822908329084290852908629087290882908929090290912909229093290942909529096290972909829099291002910129102291032910429105291062910729108291092911029111291122911329114291152911629117291182911929120291212912229123291242912529126291272912829129291302913129132291332913429135291362913729138291392914029141291422914329144291452914629147291482914929150291512915229153291542915529156291572915829159291602916129162291632916429165291662916729168291692917029171291722917329174291752917629177291782917929180291812918229183291842918529186291872918829189291902919129192291932919429195291962919729198291992920029201292022920329204292052920629207292082920929210292112921229213292142921529216292172921829219292202922129222292232922429225292262922729228292292923029231292322923329234292352923629237292382923929240292412924229243292442924529246292472924829249292502925129252292532925429255292562925729258292592926029261292622926329264292652926629267292682926929270292712927229273292742927529276292772927829279292802928129282292832928429285292862928729288292892929029291292922929329294292952929629297292982929929300293012930229303293042930529306293072930829309293102931129312293132931429315293162931729318293192932029321293222932329324293252932629327293282932929330293312933229333293342933529336293372933829339293402934129342293432934429345293462934729348293492935029351293522935329354293552935629357293582935929360293612936229363293642936529366293672936829369293702937129372293732937429375293762937729378293792938029381293822938329384293852938629387293882938929390293912939229393293942939529396293972939829399294002940129402294032940429405294062940729408294092941029411294122941329414294152941629417294182941929420294212942229423294242942529426294272942829429294302943129432294332943429435294362943729438294392944029441294422944329444294452944629447294482944929450294512945229453294542945529456294572945829459294602946129462294632946429465294662946729468294692947029471294722947329474294752947629477294782947929480294812948229483294842948529486294872948829489294902949129492294932949429495294962949729498294992950029501295022950329504295052950629507295082950929510295112951229513295142951529516295172951829519295202952129522295232952429525295262952729528295292953029531295322953329534295352953629537295382953929540295412954229543295442954529546295472954829549295502955129552295532955429555295562955729558295592956029561295622956329564295652956629567295682956929570295712957229573295742957529576295772957829579295802958129582295832958429585295862958729588295892959029591295922959329594295952959629597295982959929600296012960229603296042960529606296072960829609296102961129612296132961429615296162961729618296192962029621296222962329624296252962629627296282962929630296312963229633296342963529636296372963829639296402964129642296432964429645296462964729648296492965029651296522965329654296552965629657296582965929660296612966229663296642966529666296672966829669296702967129672296732967429675296762967729678296792968029681296822968329684296852968629687296882968929690296912969229693296942969529696296972969829699297002970129702297032970429705297062970729708297092971029711297122971329714297152971629717297182971929720297212972229723297242972529726297272972829729297302973129732297332973429735297362973729738297392974029741297422974329744297452974629747297482974929750297512975229753297542975529756297572975829759297602976129762297632976429765297662976729768297692977029771297722977329774297752977629777297782977929780297812978229783297842978529786297872978829789297902979129792297932979429795297962979729798297992980029801298022980329804298052980629807298082980929810298112981229813298142981529816298172981829819298202982129822298232982429825298262982729828298292983029831298322983329834298352983629837298382983929840298412984229843298442984529846298472984829849298502985129852298532985429855298562985729858298592986029861298622986329864298652986629867298682986929870298712987229873298742987529876298772987829879298802988129882298832988429885298862988729888298892989029891298922989329894298952989629897298982989929900299012990229903299042990529906299072990829909299102991129912299132991429915299162991729918299192992029921299222992329924299252992629927299282992929930299312993229933299342993529936299372993829939299402994129942299432994429945299462994729948299492995029951299522995329954299552995629957299582995929960299612996229963299642996529966299672996829969299702997129972299732997429975299762997729978299792998029981299822998329984299852998629987299882998929990299912999229993299942999529996299972999829999300003000130002300033000430005300063000730008300093001030011300123001330014300153001630017300183001930020300213002230023300243002530026300273002830029300303003130032300333003430035300363003730038300393004030041300423004330044300453004630047300483004930050300513005230053300543005530056300573005830059300603006130062300633006430065300663006730068300693007030071300723007330074300753007630077300783007930080300813008230083300843008530086300873008830089300903009130092300933009430095300963009730098300993010030101301023010330104301053010630107301083010930110301113011230113301143011530116301173011830119301203012130122301233012430125301263012730128301293013030131301323013330134301353013630137301383013930140301413014230143301443014530146301473014830149301503015130152301533015430155301563015730158301593016030161301623016330164301653016630167301683016930170301713017230173301743017530176301773017830179301803018130182301833018430185301863018730188301893019030191301923019330194301953019630197301983019930200302013020230203302043020530206302073020830209302103021130212302133021430215302163021730218302193022030221302223022330224302253022630227302283022930230302313023230233302343023530236302373023830239302403024130242302433024430245302463024730248302493025030251302523025330254302553025630257302583025930260302613026230263302643026530266302673026830269302703027130272302733027430275302763027730278302793028030281302823028330284302853028630287302883028930290302913029230293302943029530296302973029830299303003030130302303033030430305303063030730308303093031030311303123031330314303153031630317303183031930320303213032230323303243032530326303273032830329303303033130332303333033430335303363033730338303393034030341303423034330344303453034630347303483034930350303513035230353303543035530356303573035830359303603036130362303633036430365303663036730368303693037030371303723037330374303753037630377303783037930380303813038230383303843038530386303873038830389303903039130392303933039430395303963039730398303993040030401304023040330404304053040630407304083040930410304113041230413304143041530416304173041830419304203042130422304233042430425304263042730428304293043030431304323043330434304353043630437304383043930440304413044230443304443044530446304473044830449304503045130452304533045430455304563045730458304593046030461304623046330464304653046630467304683046930470304713047230473304743047530476304773047830479304803048130482304833048430485304863048730488304893049030491304923049330494304953049630497304983049930500305013050230503305043050530506305073050830509305103051130512305133051430515305163051730518305193052030521305223052330524305253052630527305283052930530305313053230533305343053530536305373053830539305403054130542305433054430545305463054730548305493055030551305523055330554305553055630557305583055930560305613056230563305643056530566305673056830569305703057130572305733057430575305763057730578305793058030581305823058330584305853058630587305883058930590305913059230593305943059530596305973059830599306003060130602306033060430605306063060730608306093061030611306123061330614306153061630617306183061930620306213062230623306243062530626306273062830629306303063130632306333063430635306363063730638306393064030641306423064330644306453064630647306483064930650306513065230653306543065530656306573065830659306603066130662306633066430665306663066730668306693067030671306723067330674306753067630677306783067930680306813068230683306843068530686306873068830689306903069130692306933069430695306963069730698306993070030701307023070330704307053070630707307083070930710307113071230713307143071530716307173071830719307203072130722307233072430725307263072730728307293073030731307323073330734307353073630737307383073930740307413074230743307443074530746307473074830749307503075130752307533075430755307563075730758307593076030761307623076330764307653076630767307683076930770307713077230773307743077530776307773077830779307803078130782307833078430785307863078730788307893079030791307923079330794307953079630797307983079930800308013080230803308043080530806308073080830809308103081130812308133081430815308163081730818308193082030821308223082330824308253082630827308283082930830308313083230833308343083530836308373083830839308403084130842308433084430845308463084730848308493085030851308523085330854308553085630857308583085930860308613086230863308643086530866308673086830869308703087130872308733087430875308763087730878308793088030881308823088330884308853088630887308883088930890308913089230893308943089530896308973089830899309003090130902309033090430905309063090730908309093091030911309123091330914309153091630917309183091930920309213092230923309243092530926309273092830929309303093130932309333093430935309363093730938309393094030941309423094330944309453094630947309483094930950309513095230953309543095530956309573095830959309603096130962309633096430965309663096730968309693097030971309723097330974309753097630977309783097930980309813098230983309843098530986309873098830989309903099130992309933099430995309963099730998309993100031001310023100331004310053100631007310083100931010310113101231013310143101531016310173101831019310203102131022310233102431025310263102731028310293103031031310323103331034310353103631037310383103931040310413104231043310443104531046310473104831049310503105131052310533105431055310563105731058310593106031061310623106331064310653106631067310683106931070310713107231073310743107531076310773107831079310803108131082310833108431085310863108731088310893109031091310923109331094310953109631097310983109931100311013110231103311043110531106311073110831109311103111131112311133111431115311163111731118311193112031121311223112331124311253112631127311283112931130311313113231133311343113531136311373113831139311403114131142311433114431145311463114731148311493115031151311523115331154311553115631157311583115931160311613116231163311643116531166311673116831169311703117131172311733117431175311763117731178311793118031181311823118331184311853118631187311883118931190311913119231193311943119531196311973119831199312003120131202312033120431205312063120731208312093121031211312123121331214312153121631217312183121931220312213122231223312243122531226312273122831229312303123131232312333123431235312363123731238312393124031241312423124331244312453124631247312483124931250312513125231253312543125531256312573125831259312603126131262312633126431265312663126731268312693127031271312723127331274312753127631277312783127931280312813128231283312843128531286312873128831289312903129131292312933129431295312963129731298312993130031301313023130331304313053130631307313083130931310313113131231313313143131531316313173131831319313203132131322313233132431325313263132731328313293133031331313323133331334313353133631337313383133931340313413134231343313443134531346313473134831349313503135131352313533135431355313563135731358313593136031361313623136331364313653136631367313683136931370313713137231373313743137531376313773137831379313803138131382313833138431385313863138731388313893139031391313923139331394313953139631397313983139931400314013140231403314043140531406314073140831409314103141131412314133141431415314163141731418314193142031421314223142331424314253142631427314283142931430314313143231433314343143531436314373143831439314403144131442314433144431445314463144731448314493145031451314523145331454314553145631457314583145931460314613146231463314643146531466314673146831469314703147131472314733147431475314763147731478314793148031481314823148331484314853148631487314883148931490314913149231493314943149531496314973149831499315003150131502315033150431505315063150731508315093151031511315123151331514315153151631517315183151931520315213152231523315243152531526315273152831529315303153131532315333153431535315363153731538315393154031541315423154331544315453154631547315483154931550315513155231553315543155531556315573155831559315603156131562315633156431565315663156731568315693157031571315723157331574315753157631577315783157931580315813158231583315843158531586315873158831589315903159131592315933159431595315963159731598315993160031601316023160331604316053160631607316083160931610316113161231613316143161531616316173161831619316203162131622316233162431625316263162731628316293163031631316323163331634316353163631637316383163931640316413164231643316443164531646316473164831649316503165131652316533165431655316563165731658316593166031661316623166331664316653166631667316683166931670316713167231673316743167531676316773167831679316803168131682316833168431685316863168731688316893169031691316923169331694316953169631697316983169931700317013170231703317043170531706317073170831709317103171131712317133171431715317163171731718317193172031721317223172331724317253172631727317283172931730317313173231733317343173531736317373173831739317403174131742317433174431745317463174731748317493175031751317523175331754317553175631757317583175931760317613176231763317643176531766317673176831769317703177131772317733177431775317763177731778317793178031781317823178331784317853178631787317883178931790317913179231793317943179531796317973179831799318003180131802318033180431805318063180731808318093181031811318123181331814318153181631817318183181931820318213182231823318243182531826318273182831829318303183131832318333183431835318363183731838318393184031841318423184331844318453184631847318483184931850318513185231853318543185531856318573185831859318603186131862318633186431865318663186731868318693187031871318723187331874318753187631877318783187931880318813188231883318843188531886318873188831889318903189131892318933189431895318963189731898318993190031901319023190331904319053190631907319083190931910319113191231913319143191531916319173191831919319203192131922319233192431925319263192731928319293193031931319323193331934319353193631937319383193931940319413194231943319443194531946319473194831949319503195131952319533195431955319563195731958319593196031961319623196331964319653196631967319683196931970319713197231973319743197531976319773197831979319803198131982319833198431985319863198731988319893199031991319923199331994319953199631997319983199932000320013200232003320043200532006320073200832009320103201132012320133201432015320163201732018320193202032021320223202332024320253202632027320283202932030320313203232033320343203532036320373203832039320403204132042320433204432045320463204732048320493205032051320523205332054320553205632057320583205932060320613206232063320643206532066320673206832069320703207132072320733207432075320763207732078320793208032081320823208332084320853208632087320883208932090320913209232093320943209532096320973209832099321003210132102321033210432105321063210732108321093211032111321123211332114321153211632117321183211932120321213212232123321243212532126321273212832129321303213132132321333213432135321363213732138321393214032141321423214332144321453214632147321483214932150321513215232153321543215532156321573215832159321603216132162321633216432165321663216732168321693217032171321723217332174321753217632177321783217932180321813218232183321843218532186321873218832189321903219132192321933219432195321963219732198321993220032201322023220332204322053220632207322083220932210322113221232213322143221532216322173221832219322203222132222322233222432225322263222732228322293223032231322323223332234322353223632237322383223932240322413224232243322443224532246322473224832249322503225132252322533225432255322563225732258322593226032261322623226332264322653226632267322683226932270322713227232273322743227532276322773227832279322803228132282322833228432285322863228732288322893229032291322923229332294322953229632297322983229932300323013230232303323043230532306323073230832309323103231132312323133231432315323163231732318323193232032321323223232332324323253232632327323283232932330323313233232333323343233532336323373233832339323403234132342323433234432345323463234732348323493235032351323523235332354323553235632357323583235932360323613236232363323643236532366323673236832369323703237132372323733237432375323763237732378323793238032381323823238332384323853238632387323883238932390323913239232393323943239532396323973239832399324003240132402324033240432405324063240732408324093241032411324123241332414324153241632417324183241932420324213242232423324243242532426324273242832429324303243132432324333243432435324363243732438324393244032441324423244332444324453244632447324483244932450324513245232453324543245532456324573245832459324603246132462324633246432465324663246732468324693247032471324723247332474324753247632477324783247932480324813248232483324843248532486324873248832489324903249132492324933249432495324963249732498324993250032501325023250332504325053250632507325083250932510325113251232513325143251532516325173251832519325203252132522325233252432525325263252732528325293253032531325323253332534325353253632537325383253932540325413254232543325443254532546325473254832549325503255132552325533255432555325563255732558325593256032561325623256332564325653256632567325683256932570325713257232573325743257532576325773257832579325803258132582325833258432585325863258732588325893259032591325923259332594325953259632597325983259932600326013260232603326043260532606326073260832609326103261132612326133261432615326163261732618326193262032621326223262332624326253262632627326283262932630326313263232633326343263532636326373263832639326403264132642326433264432645326463264732648326493265032651326523265332654326553265632657326583265932660326613266232663326643266532666326673266832669326703267132672326733267432675326763267732678326793268032681326823268332684326853268632687326883268932690326913269232693326943269532696326973269832699327003270132702327033270432705327063270732708327093271032711327123271332714327153271632717327183271932720327213272232723327243272532726327273272832729327303273132732327333273432735327363273732738327393274032741327423274332744327453274632747327483274932750327513275232753327543275532756327573275832759327603276132762327633276432765327663276732768327693277032771327723277332774327753277632777327783277932780327813278232783327843278532786327873278832789327903279132792327933279432795327963279732798327993280032801328023280332804328053280632807328083280932810328113281232813328143281532816328173281832819328203282132822328233282432825328263282732828328293283032831328323283332834328353283632837328383283932840328413284232843328443284532846328473284832849328503285132852328533285432855328563285732858328593286032861328623286332864328653286632867328683286932870328713287232873328743287532876328773287832879328803288132882328833288432885328863288732888328893289032891328923289332894328953289632897328983289932900329013290232903329043290532906329073290832909329103291132912329133291432915329163291732918329193292032921329223292332924329253292632927329283292932930329313293232933329343293532936329373293832939329403294132942329433294432945329463294732948329493295032951329523295332954329553295632957329583295932960329613296232963329643296532966329673296832969329703297132972329733297432975329763297732978329793298032981329823298332984329853298632987329883298932990329913299232993329943299532996329973299832999330003300133002330033300433005330063300733008330093301033011330123301333014330153301633017330183301933020330213302233023330243302533026330273302833029330303303133032330333303433035330363303733038330393304033041330423304333044330453304633047330483304933050330513305233053330543305533056330573305833059330603306133062330633306433065330663306733068330693307033071330723307333074330753307633077330783307933080330813308233083330843308533086330873308833089330903309133092330933309433095330963309733098330993310033101331023310333104331053310633107331083310933110331113311233113331143311533116331173311833119331203312133122331233312433125331263312733128331293313033131331323313333134331353313633137331383313933140331413314233143331443314533146331473314833149331503315133152331533315433155331563315733158331593316033161331623316333164331653316633167331683316933170331713317233173331743317533176331773317833179331803318133182331833318433185331863318733188331893319033191331923319333194331953319633197331983319933200332013320233203332043320533206332073320833209332103321133212332133321433215332163321733218332193322033221332223322333224332253322633227332283322933230332313323233233332343323533236332373323833239332403324133242332433324433245332463324733248332493325033251332523325333254332553325633257332583325933260332613326233263332643326533266332673326833269332703327133272332733327433275332763327733278332793328033281332823328333284332853328633287332883328933290332913329233293332943329533296332973329833299333003330133302333033330433305333063330733308333093331033311333123331333314333153331633317333183331933320333213332233323333243332533326333273332833329333303333133332333333333433335333363333733338333393334033341333423334333344333453334633347333483334933350333513335233353333543335533356333573335833359333603336133362333633336433365333663336733368333693337033371333723337333374333753337633377333783337933380333813338233383333843338533386333873338833389333903339133392333933339433395333963339733398333993340033401334023340333404334053340633407334083340933410334113341233413334143341533416334173341833419334203342133422334233342433425334263342733428334293343033431334323343333434334353343633437334383343933440334413344233443334443344533446334473344833449334503345133452334533345433455334563345733458334593346033461334623346333464334653346633467334683346933470334713347233473334743347533476334773347833479334803348133482334833348433485334863348733488334893349033491334923349333494334953349633497334983349933500335013350233503335043350533506335073350833509335103351133512335133351433515335163351733518335193352033521335223352333524335253352633527335283352933530335313353233533335343353533536335373353833539335403354133542335433354433545335463354733548335493355033551335523355333554335553355633557335583355933560335613356233563335643356533566335673356833569335703357133572335733357433575335763357733578335793358033581335823358333584335853358633587335883358933590335913359233593335943359533596335973359833599336003360133602336033360433605336063360733608336093361033611336123361333614336153361633617336183361933620336213362233623336243362533626336273362833629336303363133632336333363433635336363363733638336393364033641336423364333644336453364633647336483364933650336513365233653336543365533656336573365833659336603366133662336633366433665336663366733668336693367033671336723367333674336753367633677336783367933680336813368233683336843368533686336873368833689336903369133692336933369433695336963369733698336993370033701337023370333704337053370633707337083370933710337113371233713337143371533716337173371833719337203372133722337233372433725337263372733728337293373033731337323373333734337353373633737337383373933740337413374233743337443374533746337473374833749337503375133752337533375433755337563375733758337593376033761337623376333764337653376633767337683376933770337713377233773337743377533776337773377833779337803378133782337833378433785337863378733788337893379033791337923379333794337953379633797337983379933800338013380233803338043380533806338073380833809338103381133812338133381433815338163381733818338193382033821338223382333824338253382633827338283382933830338313383233833338343383533836338373383833839338403384133842338433384433845338463384733848338493385033851338523385333854338553385633857338583385933860338613386233863338643386533866338673386833869338703387133872338733387433875338763387733878338793388033881338823388333884338853388633887338883388933890338913389233893338943389533896338973389833899339003390133902339033390433905339063390733908339093391033911339123391333914339153391633917339183391933920339213392233923339243392533926339273392833929339303393133932339333393433935339363393733938339393394033941339423394333944339453394633947339483394933950339513395233953339543395533956339573395833959339603396133962339633396433965339663396733968339693397033971339723397333974339753397633977339783397933980339813398233983339843398533986339873398833989339903399133992339933399433995339963399733998339993400034001340023400334004340053400634007340083400934010340113401234013340143401534016340173401834019340203402134022340233402434025340263402734028340293403034031340323403334034340353403634037340383403934040340413404234043340443404534046340473404834049340503405134052340533405434055340563405734058340593406034061340623406334064340653406634067340683406934070340713407234073340743407534076340773407834079340803408134082340833408434085340863408734088340893409034091340923409334094340953409634097340983409934100341013410234103341043410534106341073410834109341103411134112341133411434115341163411734118341193412034121341223412334124341253412634127341283412934130341313413234133341343413534136341373413834139341403414134142341433414434145341463414734148341493415034151341523415334154341553415634157341583415934160341613416234163341643416534166341673416834169341703417134172341733417434175341763417734178341793418034181341823418334184341853418634187341883418934190341913419234193341943419534196341973419834199342003420134202342033420434205342063420734208342093421034211342123421334214342153421634217342183421934220342213422234223342243422534226342273422834229342303423134232342333423434235342363423734238342393424034241342423424334244342453424634247342483424934250342513425234253342543425534256342573425834259342603426134262342633426434265342663426734268342693427034271342723427334274342753427634277342783427934280342813428234283342843428534286342873428834289342903429134292342933429434295342963429734298342993430034301343023430334304343053430634307343083430934310343113431234313343143431534316343173431834319343203432134322343233432434325343263432734328343293433034331343323433334334343353433634337343383433934340343413434234343343443434534346343473434834349343503435134352343533435434355343563435734358343593436034361343623436334364343653436634367343683436934370343713437234373343743437534376343773437834379343803438134382343833438434385343863438734388343893439034391343923439334394343953439634397343983439934400344013440234403344043440534406344073440834409344103441134412344133441434415344163441734418344193442034421344223442334424344253442634427344283442934430344313443234433344343443534436344373443834439344403444134442344433444434445344463444734448344493445034451344523445334454344553445634457344583445934460344613446234463344643446534466344673446834469344703447134472344733447434475344763447734478344793448034481344823448334484344853448634487344883448934490344913449234493344943449534496344973449834499345003450134502345033450434505345063450734508345093451034511345123451334514345153451634517345183451934520345213452234523345243452534526345273452834529345303453134532345333453434535345363453734538345393454034541345423454334544345453454634547345483454934550345513455234553345543455534556345573455834559345603456134562345633456434565345663456734568345693457034571345723457334574345753457634577345783457934580345813458234583345843458534586345873458834589345903459134592345933459434595345963459734598345993460034601346023460334604346053460634607346083460934610346113461234613346143461534616346173461834619346203462134622346233462434625346263462734628346293463034631346323463334634346353463634637346383463934640346413464234643346443464534646346473464834649346503465134652346533465434655346563465734658346593466034661346623466334664346653466634667346683466934670346713467234673346743467534676346773467834679346803468134682346833468434685346863468734688346893469034691346923469334694346953469634697346983469934700347013470234703347043470534706347073470834709347103471134712347133471434715347163471734718347193472034721347223472334724347253472634727347283472934730347313473234733347343473534736347373473834739347403474134742347433474434745347463474734748347493475034751347523475334754347553475634757347583475934760347613476234763347643476534766347673476834769347703477134772347733477434775347763477734778347793478034781347823478334784347853478634787347883478934790347913479234793347943479534796347973479834799348003480134802348033480434805348063480734808348093481034811348123481334814348153481634817348183481934820348213482234823348243482534826348273482834829348303483134832348333483434835348363483734838348393484034841348423484334844348453484634847348483484934850348513485234853348543485534856348573485834859348603486134862348633486434865348663486734868348693487034871348723487334874348753487634877348783487934880348813488234883348843488534886348873488834889348903489134892348933489434895348963489734898348993490034901349023490334904349053490634907349083490934910349113491234913349143491534916349173491834919349203492134922349233492434925349263492734928349293493034931349323493334934349353493634937349383493934940349413494234943349443494534946349473494834949349503495134952349533495434955349563495734958349593496034961349623496334964349653496634967349683496934970349713497234973349743497534976349773497834979349803498134982349833498434985349863498734988349893499034991349923499334994349953499634997349983499935000350013500235003350043500535006350073500835009350103501135012350133501435015350163501735018350193502035021350223502335024350253502635027350283502935030350313503235033350343503535036350373503835039350403504135042350433504435045350463504735048350493505035051350523505335054350553505635057350583505935060350613506235063350643506535066350673506835069350703507135072350733507435075350763507735078350793508035081350823508335084350853508635087350883508935090350913509235093350943509535096350973509835099351003510135102351033510435105351063510735108351093511035111351123511335114351153511635117351183511935120351213512235123351243512535126351273512835129351303513135132351333513435135351363513735138351393514035141351423514335144351453514635147351483514935150351513515235153351543515535156351573515835159351603516135162351633516435165351663516735168351693517035171351723517335174351753517635177351783517935180351813518235183351843518535186351873518835189351903519135192351933519435195351963519735198351993520035201352023520335204352053520635207352083520935210352113521235213352143521535216352173521835219352203522135222352233522435225352263522735228352293523035231352323523335234352353523635237352383523935240352413524235243352443524535246352473524835249352503525135252352533525435255352563525735258352593526035261352623526335264352653526635267352683526935270352713527235273352743527535276352773527835279352803528135282352833528435285352863528735288352893529035291352923529335294352953529635297352983529935300353013530235303353043530535306353073530835309353103531135312353133531435315353163531735318353193532035321353223532335324353253532635327353283532935330353313533235333353343533535336353373533835339353403534135342353433534435345353463534735348353493535035351353523535335354353553535635357353583535935360353613536235363353643536535366353673536835369353703537135372353733537435375353763537735378353793538035381353823538335384353853538635387353883538935390353913539235393353943539535396353973539835399354003540135402354033540435405354063540735408354093541035411354123541335414354153541635417354183541935420354213542235423354243542535426354273542835429354303543135432354333543435435354363543735438354393544035441354423544335444354453544635447354483544935450354513545235453354543545535456354573545835459354603546135462354633546435465354663546735468354693547035471354723547335474354753547635477354783547935480354813548235483354843548535486354873548835489354903549135492354933549435495354963549735498354993550035501355023550335504355053550635507355083550935510355113551235513355143551535516355173551835519355203552135522355233552435525355263552735528355293553035531355323553335534355353553635537355383553935540355413554235543355443554535546355473554835549355503555135552355533555435555355563555735558355593556035561355623556335564355653556635567355683556935570355713557235573355743557535576355773557835579355803558135582355833558435585355863558735588355893559035591355923559335594355953559635597355983559935600356013560235603356043560535606356073560835609356103561135612356133561435615356163561735618356193562035621356223562335624356253562635627356283562935630356313563235633356343563535636356373563835639356403564135642356433564435645356463564735648356493565035651356523565335654356553565635657356583565935660356613566235663356643566535666356673566835669356703567135672356733567435675356763567735678356793568035681356823568335684356853568635687356883568935690356913569235693356943569535696356973569835699357003570135702357033570435705357063570735708357093571035711357123571335714357153571635717357183571935720357213572235723357243572535726357273572835729357303573135732357333573435735357363573735738357393574035741357423574335744357453574635747357483574935750357513575235753357543575535756357573575835759357603576135762357633576435765357663576735768357693577035771357723577335774357753577635777357783577935780357813578235783357843578535786357873578835789357903579135792357933579435795357963579735798357993580035801358023580335804358053580635807358083580935810358113581235813358143581535816358173581835819358203582135822358233582435825358263582735828358293583035831358323583335834358353583635837358383583935840358413584235843358443584535846358473584835849358503585135852358533585435855358563585735858358593586035861358623586335864358653586635867358683586935870358713587235873358743587535876358773587835879358803588135882358833588435885358863588735888358893589035891358923589335894358953589635897358983589935900359013590235903359043590535906359073590835909359103591135912359133591435915359163591735918359193592035921359223592335924359253592635927359283592935930359313593235933359343593535936359373593835939359403594135942359433594435945359463594735948359493595035951359523595335954359553595635957359583595935960359613596235963359643596535966359673596835969359703597135972359733597435975359763597735978359793598035981359823598335984359853598635987359883598935990359913599235993359943599535996359973599835999360003600136002360033600436005360063600736008360093601036011360123601336014360153601636017360183601936020360213602236023360243602536026360273602836029360303603136032360333603436035360363603736038360393604036041360423604336044360453604636047360483604936050360513605236053360543605536056360573605836059360603606136062360633606436065360663606736068360693607036071360723607336074360753607636077360783607936080360813608236083360843608536086360873608836089360903609136092360933609436095360963609736098360993610036101361023610336104361053610636107361083610936110361113611236113361143611536116361173611836119361203612136122361233612436125361263612736128361293613036131361323613336134361353613636137361383613936140361413614236143361443614536146361473614836149361503615136152361533615436155361563615736158361593616036161361623616336164361653616636167361683616936170361713617236173361743617536176361773617836179361803618136182361833618436185361863618736188361893619036191361923619336194361953619636197361983619936200362013620236203362043620536206362073620836209362103621136212362133621436215362163621736218362193622036221362223622336224362253622636227362283622936230362313623236233362343623536236362373623836239362403624136242362433624436245362463624736248362493625036251362523625336254362553625636257362583625936260362613626236263362643626536266362673626836269362703627136272362733627436275362763627736278362793628036281362823628336284362853628636287362883628936290362913629236293362943629536296362973629836299363003630136302363033630436305363063630736308363093631036311363123631336314363153631636317363183631936320363213632236323363243632536326363273632836329363303633136332363333633436335363363633736338363393634036341363423634336344363453634636347363483634936350363513635236353363543635536356363573635836359363603636136362363633636436365363663636736368363693637036371363723637336374363753637636377363783637936380363813638236383363843638536386363873638836389363903639136392363933639436395363963639736398363993640036401364023640336404364053640636407364083640936410364113641236413364143641536416364173641836419364203642136422364233642436425364263642736428364293643036431364323643336434364353643636437364383643936440364413644236443364443644536446364473644836449364503645136452364533645436455364563645736458364593646036461364623646336464364653646636467364683646936470364713647236473364743647536476364773647836479364803648136482364833648436485364863648736488364893649036491364923649336494364953649636497364983649936500365013650236503365043650536506365073650836509365103651136512365133651436515365163651736518365193652036521365223652336524365253652636527365283652936530365313653236533365343653536536365373653836539365403654136542365433654436545365463654736548365493655036551365523655336554365553655636557365583655936560365613656236563365643656536566365673656836569365703657136572365733657436575365763657736578365793658036581365823658336584365853658636587365883658936590365913659236593365943659536596365973659836599366003660136602366033660436605366063660736608366093661036611366123661336614366153661636617366183661936620366213662236623366243662536626366273662836629366303663136632366333663436635366363663736638366393664036641366423664336644366453664636647366483664936650366513665236653366543665536656366573665836659366603666136662366633666436665366663666736668366693667036671366723667336674366753667636677366783667936680366813668236683366843668536686366873668836689366903669136692366933669436695366963669736698366993670036701367023670336704367053670636707367083670936710367113671236713367143671536716367173671836719367203672136722367233672436725367263672736728367293673036731367323673336734367353673636737367383673936740367413674236743367443674536746367473674836749367503675136752367533675436755367563675736758367593676036761367623676336764367653676636767367683676936770367713677236773367743677536776367773677836779367803678136782367833678436785367863678736788367893679036791367923679336794367953679636797367983679936800368013680236803368043680536806368073680836809368103681136812368133681436815368163681736818368193682036821368223682336824368253682636827368283682936830 |
- <!doctype html>
- <html lang="en" class="no-js">
- <head>
-
- <meta charset="utf-8">
- <meta name="viewport" content="width=device-width,initial-scale=1">
-
-
-
-
- <link rel="prev" href="../generator/sshkey/">
-
-
- <link rel="next" href="../controller-options/">
-
-
-
-
-
- <link rel="icon" href="../../pictures/eso-round-logo.svg">
- <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.7">
-
-
-
- <title>API specification - External Secrets Operator</title>
-
-
-
- <link rel="stylesheet" href="../../assets/stylesheets/main.ec1eaa64.min.css">
-
-
- <link rel="stylesheet" href="../../assets/stylesheets/palette.ab4e12ef.min.css">
-
-
-
-
-
-
-
-
-
-
- <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
- <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
- <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
-
-
-
- <script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
-
-
-
-
-
- <script id="__analytics">function __md_analytics(){function e(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],e("js",new Date),e("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",(function(){document.forms.search&&document.forms.search.query.addEventListener("blur",(function(){this.value&&e("event","search",{search_term:this.value})}));document$.subscribe((function(){var t=document.forms.feedback;if(void 0!==t)for(var a of t.querySelectorAll("[type=submit]"))a.addEventListener("click",(function(a){a.preventDefault();var n=document.location.pathname,d=this.getAttribute("data-md-value");e("event","feedback",{page:n,data:d}),t.firstElementChild.disabled=!0;var r=t.querySelector(".md-feedback__note [data-md-value='"+d+"']");r&&(r.hidden=!1)})),t.hidden=!1})),location$.subscribe((function(t){e("config","G-QP38TD8K7V",{page_path:t.pathname})}))}));var t=document.createElement("script");t.async=!0,t.src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V",document.getElementById("__analytics").insertAdjacentElement("afterEnd",t)}</script>
-
- <script>"undefined"!=typeof __md_analytics&&__md_analytics()</script>
-
-
-
- </head>
-
-
-
-
-
-
-
-
-
- <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
-
-
- <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
- <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
- <label class="md-overlay" for="__drawer"></label>
- <div data-md-component="skip">
-
- </div>
- <div data-md-component="announce">
-
- </div>
-
- <div data-md-color-scheme="default" data-md-component="outdated" hidden>
-
- <aside class="md-banner md-banner--warning">
- <div class="md-banner__inner md-grid md-typeset">
-
- You're not viewing the latest version.
- <a href="../../..">
- <strong>Click here to go to latest.</strong>
- </a>
- </div>
- <script>var el=document.querySelector("[data-md-component=outdated]"),base=new URL("../.."),outdated=__md_get("__outdated",sessionStorage,base);!0===outdated&&el&&(el.hidden=!1)</script>
- </aside>
-
- </div>
-
-
-
- <header class="md-header" data-md-component="header">
- <nav class="md-header__inner md-grid" aria-label="Header">
- <a href="../.." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
-
- <img src="../../pictures/eso-round-logo.svg" alt="logo">
- </a>
- <label class="md-header__button md-icon" for="__drawer">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
- </label>
- <div class="md-header__title" data-md-component="header-title">
- <div class="md-header__ellipsis">
- <div class="md-header__topic">
- <span class="md-ellipsis">
- External Secrets Operator
- </span>
- </div>
- <div class="md-header__topic" data-md-component="header-topic">
- <span class="md-ellipsis">
-
- API specification
-
- </span>
- </div>
- </div>
- </div>
-
-
- <form class="md-header__option" data-md-component="palette">
-
-
-
-
- <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_0">
-
- <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
- </label>
-
-
-
-
-
- <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_1">
-
- <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
- </label>
-
-
- </form>
-
-
-
- <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
-
-
-
-
-
- <label class="md-header__button md-icon" for="__search">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
- </label>
- <div class="md-search" data-md-component="search" role="dialog">
- <label class="md-search__overlay" for="__search"></label>
- <div class="md-search__inner" role="search">
- <form class="md-search__form" name="search">
- <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
- <label class="md-search__icon md-icon" for="__search">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
- </label>
- <nav class="md-search__options" aria-label="Search">
-
- <button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
- </button>
- </nav>
-
- </form>
- <div class="md-search__output">
- <div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
- <div class="md-search-result" data-md-component="search-result">
- <div class="md-search-result__meta">
- Initializing search
- </div>
- <ol class="md-search-result__list" role="presentation"></ol>
- </div>
- </div>
- </div>
- </div>
- </div>
-
-
-
- <div class="md-header__source">
- <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
- <div class="md-source__icon md-icon">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
- </div>
- <div class="md-source__repository">
- External Secrets Operator
- </div>
- </a>
- </div>
-
- </nav>
-
- </header>
-
- <div class="md-container" data-md-component="container">
-
-
-
-
-
- <nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
- <div class="md-grid">
- <ul class="md-tabs__list">
-
-
-
-
-
-
-
-
- <li class="md-tabs__item">
- <a href="../.." class="md-tabs__link">
-
-
-
-
-
- Introduction
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-tabs__item md-tabs__item--active">
- <a href="../components/" class="md-tabs__link">
-
-
-
-
-
- API
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
- <li class="md-tabs__item">
- <a href="../../guides/introduction/" class="md-tabs__link">
-
-
-
-
-
- Guides
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
- <li class="md-tabs__item">
- <a href="../../provider/aws-secrets-manager/" class="md-tabs__link">
-
-
-
-
-
- Provider
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
- <li class="md-tabs__item">
- <a href="../../examples/gitops-using-fluxcd/" class="md-tabs__link">
-
-
-
-
-
- Examples
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-tabs__item">
- <a href="../../contributing/devguide/" class="md-tabs__link">
-
-
-
-
-
- Community
- </a>
- </li>
-
-
-
-
-
- </ul>
- </div>
- </nav>
-
-
-
- <main class="md-main" data-md-component="main">
- <div class="md-main__inner md-grid">
-
-
-
- <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
- <div class="md-sidebar__scrollwrap">
- <div class="md-sidebar__inner">
-
-
- <nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
- <label class="md-nav__title" for="__drawer">
- <a href="../.." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
-
- <img src="../../pictures/eso-round-logo.svg" alt="logo">
- </a>
- External Secrets Operator
- </label>
-
- <div class="md-nav__source">
- <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
- <div class="md-source__icon md-icon">
-
- <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
- </div>
- <div class="md-source__repository">
- External Secrets Operator
- </div>
- </a>
- </div>
-
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_1" >
-
-
- <div class="md-nav__link md-nav__container">
- <a href="../.." class="md-nav__link ">
-
-
-
- <span class="md-ellipsis">
-
-
- Introduction
-
-
- </span>
-
-
- </a>
-
-
- <label class="md-nav__link " for="__nav_1" id="__nav_1_label" tabindex="0">
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- </div>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_1_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_1">
- <span class="md-nav__icon md-icon"></span>
-
-
- Introduction
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/overview/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Overview
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/glossary/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Glossary
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/prerequisites/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Prerequisites
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/getting-started/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Getting started
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/faq/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- FAQ
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/stability-support/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Stability and Support
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../introduction/deprecation-policy/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Deprecation Policy
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
-
-
-
- <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2" checked>
-
-
- <label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="">
-
-
-
- <span class="md-ellipsis">
-
-
- API
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="true">
- <label class="md-nav__title" for="__nav_2">
- <span class="md-nav__icon md-icon"></span>
-
-
- API
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../components/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Components
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_2" >
-
-
- <label class="md-nav__link" for="__nav_2_2" id="__nav_2_2_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Core Resources
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_2_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_2_2">
- <span class="md-nav__icon md-icon"></span>
-
-
- Core Resources
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../externalsecret/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- ExternalSecret
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../secretstore/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- SecretStore
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../clustersecretstore/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- ClusterSecretStore
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../clusterexternalsecret/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- ClusterExternalSecret
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../clusterpushsecret/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- ClusterPushSecret
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../pushsecret/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- PushSecret
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_3" >
-
-
- <div class="md-nav__link md-nav__container">
- <a href="../generator/" class="md-nav__link ">
-
-
-
- <span class="md-ellipsis">
-
-
- Generators
-
-
- </span>
-
-
- </a>
-
-
- <label class="md-nav__link " for="__nav_2_3" id="__nav_2_3_label" tabindex="0">
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- </div>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_2_3">
- <span class="md-nav__icon md-icon"></span>
-
-
- Generators
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/acr/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Azure Container Registry
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/ecr/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS Elastic Container Registry
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/sts/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS STS Session Token
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/cloudsmith/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Cloudsmith
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/cluster/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Cluster Generator
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/gcr/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Google Container Registry
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/grafana/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Grafana
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/quay/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Quay
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/vault/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Vault Dynamic Secret
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/beyondtrustworkloadcredentials/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- BeyondTrust Workload Credentials
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/password/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Password
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/fake/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Fake
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/webhook/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Webhook
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/github/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Github
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/gitlab/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Gitlab
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/uuid/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- UUID
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/mfa/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- MFA
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../generator/sshkey/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- SSHKey
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--active md-nav__item--nested">
-
-
-
- <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_4" checked>
-
-
- <label class="md-nav__link" for="__nav_2_4" id="__nav_2_4_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Reference Docs
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_4_label" aria-expanded="true">
- <label class="md-nav__title" for="__nav_2_4">
- <span class="md-nav__icon md-icon"></span>
-
-
- Reference Docs
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--active">
-
- <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
-
-
-
- <a href="./" class="md-nav__link md-nav__link--active">
-
-
-
- <span class="md-ellipsis">
-
-
- API specification
-
-
- </span>
-
-
- </a>
-
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../controller-options/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Controller Options
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../metrics/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Metrics
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../selectable-fields/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Selectable Fields
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3" >
-
-
- <label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Guides
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_3">
- <span class="md-nav__icon md-icon"></span>
-
-
- Guides
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/introduction/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Introduction
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2" >
-
-
- <label class="md-nav__link" for="__nav_3_2" id="__nav_3_2_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- External Secrets
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_2_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_3_2">
- <span class="md-nav__icon md-icon"></span>
-
-
- External Secrets
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/all-keys-one-secret/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Extract structured data
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/getallsecrets/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Find Secrets by Name or Metadata
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/datafrom-rewrite/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Rewriting Keys
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2_4" >
-
-
- <label class="md-nav__link" for="__nav_3_2_4" id="__nav_3_2_4_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Advanced Templating
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_3_2_4_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_3_2_4">
- <span class="md-nav__icon md-icon"></span>
-
-
- Advanced Templating
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/templating/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- v2
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/templating-v1/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- v1
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/common-k8s-secret-types/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Kubernetes Secret Types
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/ownership-deletion-policy/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Lifecycle: ownership & deletion
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/decoding-strategy/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Decoding Strategies
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/controller-class/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Controller Classes
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/targeting-custom-resources/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Targeting Custom Resources
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/generator/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Generators
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/pushsecrets/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Push Secrets
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_6" >
-
-
- <label class="md-nav__link" for="__nav_3_6" id="__nav_3_6_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Operations
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_6_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_3_6">
- <span class="md-nav__icon md-icon"></span>
-
-
- Operations
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/multi-tenancy/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Multi Tenancy
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/security-best-practices/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Security Best Practices
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/threat-model/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Threat Model
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/v1beta1/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Upgrading to v1beta1
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/using-latest-image/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Using Latest Image
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/disable-cluster-features/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Disable Cluster Features
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_7" >
-
-
- <label class="md-nav__link" for="__nav_3_7" id="__nav_3_7_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Tooling
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_7_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_3_7">
- <span class="md-nav__icon md-icon"></span>
-
-
- Tooling
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../guides/using-esoctl-tool/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Using the esoctl tool
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_4" >
-
-
- <label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Provider
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_4">
- <span class="md-nav__icon md-icon"></span>
-
-
- Provider
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/aws-secrets-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS Secrets Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/aws-parameter-store/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS Parameter Store
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/aws-certificate-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS Certificate Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/aws-access/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- AWS Access
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/azure-key-vault/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Azure Key Vault
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/barbican/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Barbican
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/beyondtrust/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- BeyondTrust
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/beyondtrustworkloadcredentials/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- BeyondTrust Workload Credentials
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/bitwarden-secrets-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Bitwarden Secrets Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/chef/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Chef
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/cloudru/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Cloud.ru Secret Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/conjur/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- CyberArk Conjur
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/google-secrets-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Google Cloud Secret Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/hashicorp-vault/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- HashiCorp Vault
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/kubernetes/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Kubernetes
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/crd/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Kubernetes CRD
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/ibm-secrets-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- IBM Secrets Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/akeyless/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Akeyless
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/yandex-certificate-manager/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Yandex Certificate Manager
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/yandex-lockbox/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Yandex Lockbox
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/gitlab-variables/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- GitLab Variables
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/github/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- GitHub Actions and Dependabot Secrets
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/oracle-vault/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Oracle Vault
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/ovhcloud/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- OVHcloud
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/1password-automation/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- 1Password Connect Server
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/1password-sdk/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- 1Password SDK
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/webhook/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Webhook
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/fake/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Fake
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/senhasegura-dsm/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- senhasegura DevOps Secrets Management (DSM)
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/doppler/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Doppler
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/keeper-security/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Keeper Security
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/cloak/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Cloak End 2 End Encrypted Secrets
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/scaleway/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Scaleway
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/delinea/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Delinea
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/secretserver/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Secret Server
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/passbolt/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Passbolt
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/pulumi/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Pulumi ESC
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/onboardbase/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Onboardbase
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider-passworddepot/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Password Depot
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/fortanix/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Fortanix
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/infisical/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Infisical
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/previder/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Previder
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/openbao/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- OpenBao
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/volcengine/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Volcengine
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/ngrok/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- ngrok
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/devolutions-server/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Devolutions Server
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../provider/nebius-mysterybox/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Nebius MysteryBox
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_5" >
-
-
- <label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Examples
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_5">
- <span class="md-nav__icon md-icon"></span>
-
-
- Examples
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../examples/gitops-using-fluxcd/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- FluxCD
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../examples/anchore-engine-credentials/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Anchore Engine
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../examples/jenkins-kubernetes-credentials/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Jenkins
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../examples/bitwarden/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Bitwarden
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6" >
-
-
- <label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Community
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_6">
- <span class="md-nav__icon md-icon"></span>
-
-
- Community
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_1" >
-
-
- <label class="md-nav__link" for="__nav_6_1" id="__nav_6_1_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- Contributing
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_1_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_6_1">
- <span class="md-nav__icon md-icon"></span>
-
-
- Contributing
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/devguide/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Developer guide
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/process/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Contributing Process
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/release/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Release Process
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/coc/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Code of Conduct
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/calendar/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Community meetings calendar
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/roadmap/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Roadmap
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/burnout-mitigation/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Burnout Prevention
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../contributing/llm-policy/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- LLM Policy
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item md-nav__item--nested">
-
-
-
-
-
- <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_2" >
-
-
- <label class="md-nav__link" for="__nav_6_2" id="__nav_6_2_label" tabindex="0">
-
-
-
- <span class="md-ellipsis">
-
-
- External Resources
-
-
- </span>
-
-
- <span class="md-nav__icon md-icon"></span>
- </label>
-
- <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_2_label" aria-expanded="false">
- <label class="md-nav__title" for="__nav_6_2">
- <span class="md-nav__icon md-icon"></span>
-
-
- External Resources
-
- </label>
- <ul class="md-nav__list" data-md-scrollfix>
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../eso-talks/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Talks
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../eso-demos/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Demos
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../eso-blogs/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Blogs
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
-
-
-
-
-
-
- <li class="md-nav__item">
- <a href="../../eso-tools/" class="md-nav__link">
-
-
-
- <span class="md-ellipsis">
-
-
- Tools
-
-
- </span>
-
-
- </a>
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
-
- </ul>
- </nav>
-
- </li>
-
-
- </ul>
- </nav>
- </div>
- </div>
- </div>
-
-
-
- <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
- <div class="md-sidebar__scrollwrap">
- <div class="md-sidebar__inner">
-
- <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
-
-
-
-
- </nav>
- </div>
- </div>
- </div>
-
-
-
- <div class="md-content" data-md-component="content">
-
- <article class="md-content__inner md-typeset">
-
-
-
-
- <p>Packages:</p>
- <ul>
- <li>
- <a href="#external-secrets.io%2fv1">external-secrets.io/v1</a>
- </li>
- <li>
- <a href="#external-secrets.io%2fv1alpha1">external-secrets.io/v1alpha1</a>
- </li>
- <li>
- <a href="#external-secrets.io%2fv1beta1">external-secrets.io/v1beta1</a>
- </li>
- <li>
- <a href="#generators.external-secrets.io%2fv1alpha1">generators.external-secrets.io/v1alpha1</a>
- </li>
- </ul>
- <h2 id="external-secrets.io/v1">external-secrets.io/v1</h2>
- <p>
- <p>Package v1 contains resources for external-secrets</p>
- </p>
- <p>Resource Types:</p>
- <ul></ul>
- <h3 id="external-secrets.io/v1.AWSAuth">AWSAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>AWSAuth tells the controller how to do authentication with aws.
- Only one of secretRef or jwt can be specified.
- if none is specified the controller will load credentials using the aws sdk defaults.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.AWSAuthSecretRef">
- AWSAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1.AWSJWTAuth">
- AWSJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AWSAuthSecretRef">AWSAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSAuthSecretRef holds secret references for AWS credentials
- both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SessionToken used for authentication
- This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
- see: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AWSJWTAuth">AWSJWTAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSJWTAuth stores reference to Authenticate against AWS using service account tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AWSProvider">AWSProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AWSProvider configures a store to sync secrets with AWS.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>service</code></br>
- <em>
- <a href="#external-secrets.io/v1.AWSServiceType">
- AWSServiceType
- </a>
- </em>
- </td>
- <td>
- <p>Service defines which service should be used to fetch the secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines the information necessary to authenticate against AWS
- if not set aws sdk will infer credentials from your environment
- see: <a href="https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials">https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Role is a Role ARN which the provider will assume</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS Region to be used for the provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>additionalRoles</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS External ID set on assumed IAM roles</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTags</code></br>
- <em>
- <a href="#external-secrets.io/v1.*github.com/external-secrets/external-secrets/apis/externalsecrets/v1.Tag">
- []*github.com/external-secrets/external-secrets/apis/externalsecrets/v1.Tag
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS STS assume role session tags</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretsManager</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretsManager">
- SecretsManager
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretsManager defines how the provider behaves when interacting with AWS SecretsManager</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>transitiveTagKeys</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS STS assume role transitive session tags. Required when multiple rules are used with the provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTagsPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.SessionTagsPolicy">
- SessionTagsPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SessionTagsPolicy controls whether and how STS session tags are added when assuming roles.
- None (default): no tags are added.
- Simple: automatically adds esoNamespace (from the ExternalSecret), esoStoreName, and esoStoreKind tags.
- Custom: adds esoNamespace, esoStoreName, and esoStoreKind plus any tags defined in CustomSessionTags.
- Note: the IAM role must have sts:TagSession permission when using Simple or Custom.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>customSessionTags</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CustomSessionTags defines additional STS session tags to include when SessionTagsPolicy is Custom.
- These are merged with the automatically injected esoNamespace, esoStoreName, and esoStoreKind tags.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>prefix</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Prefix adds a prefix to all retrieved values.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AWSServiceType">AWSServiceType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>AWSServiceType is a enum that defines the service/API that is used to fetch the secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"CertificateManager"</p></td>
- <td><p>AWSServiceCertificateManager is the AWS Certificate Manager service.
- see: <a href="https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html">https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html</a></p>
- </td>
- </tr><tr><td><p>"ParameterStore"</p></td>
- <td><p>AWSServiceParameterStore is the AWS SystemsManager ParameterStore service.
- see: <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html">https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html</a></p>
- </td>
- </tr><tr><td><p>"SecretsManager"</p></td>
- <td><p>AWSServiceSecretsManager is the AWS SecretsManager service.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html">https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html</a></p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.AkeylessAuth">AkeylessAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AkeylessProvider">AkeylessProvider</a>)
- </p>
- <p>
- <p>AkeylessAuth configures how the operator authenticates with Akeyless.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.AkeylessAuthSecretRef">
- AkeylessAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reference to a Secret that contains the details
- to authenticate with Akeyless.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetesAuth</code></br>
- <em>
- <a href="#external-secrets.io/v1.AkeylessKubernetesAuth">
- AkeylessKubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes authenticates with Akeyless by passing the ServiceAccount
- token stored in the named Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specifies a Kubernetes ServiceAccount used for azure_ad
- authentication on AKS Workload Identity. The operator obtains a federated
- identity token from this ServiceAccount via the TokenRequest API instead
- of using the ESO controller pod identity. Ignored for other access types.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AkeylessAuthSecretRef">AkeylessAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AkeylessAuth">AkeylessAuth</a>)
- </p>
- <p>
- <p>AkeylessAuthSecretRef references a Secret that contains the details
- to authenticate with Akeyless.
- AKEYLESS_ACCESS_TYPE_PARAM: AZURE_OBJ_ID OR GCP_AUDIENCE OR ACCESS_KEY OR KUB_CONFIG_NAME.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessID</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessType</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessTypeParam</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AkeylessKubernetesAuth">AkeylessKubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AkeylessAuth">AkeylessAuth</a>)
- </p>
- <p>
- <p>AkeylessKubernetesAuth configures Kubernetes authentication with Akeyless.
- It authenticates with Kubernetes ServiceAccount token stored.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the Akeyless Kubernetes auth-method access-id</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>k8sConfName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Kubernetes-auth configuration name in Akeyless-Gateway</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional service account field containing the name of a kubernetes ServiceAccount.
- If the service account is specified, the service account secret token JWT will be used
- for authenticating with Akeyless. If the service account selector is not supplied,
- the secretRef will be used instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Akeyless. If a name is specified without a key,
- <code>token</code> is the default. If one is not specified, the one bound to
- the controller will be used.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AkeylessProvider">AkeylessProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AkeylessProvider Configures an store to sync secrets using Akeyless KV.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>akeylessGWApiURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Akeyless GW API Url from which the secrets to be fetched from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ignoreCache</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>IgnoreCache bypasses the Gateway cache for secret reads when true.
- Only relevant when akeylessGWApiURL points to an Akeyless Gateway.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authSecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.AkeylessAuth">
- AkeylessAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the operator authenticates with Akeyless.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
- if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Akeyless Gateway certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AuthorizationProtocol">AuthorizationProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>AuthorizationProtocol contains the protocol-specific configuration</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>ntlm</code></br>
- <em>
- <a href="#external-secrets.io/v1.NTLMProtocol">
- NTLMProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>NTLMProtocol configures the store to use NTLM for auth</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AwsAuthCredentials">AwsAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>AwsAuthCredentials represents the credentials for AWS authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AwsCredentialsConfig">AwsCredentialsConfig
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentityFederation">GCPWorkloadIdentityFederation</a>)
- </p>
- <p>
- <p>AwsCredentialsConfig holds the region and the Secret reference which contains the AWS credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>region is for configuring the AWS region to be used.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>awsCredentialsSecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretReference">
- SecretReference
- </a>
- </em>
- </td>
- <td>
- <p>awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials.
- Secret should be created with below names for keys
- - aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user.
- - aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services.
- - aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureAuthCredentials">AzureAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>AzureAuthCredentials represents the credentials for Azure authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>resource</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureAuthType">AzureAuthType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureAuthType describes how to authenticate to the Azure Keyvault
- Only one of the following auth types may be specified.
- If none of the following auth type is specified, the default one
- is ServicePrincipal.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ManagedIdentity"</p></td>
- <td><p>AzureManagedIdentity uses Managed Identity to authenticate. Used with aad-pod-identity installed in the cluster.</p>
- </td>
- </tr><tr><td><p>"ServicePrincipal"</p></td>
- <td><p>AzureServicePrincipal uses service principal to authenticate, which needs a tenantId, a clientId and a clientSecret.</p>
- </td>
- </tr><tr><td><p>"WorkloadIdentity"</p></td>
- <td><p>AzureWorkloadIdentity uses Workload Identity service accounts to authenticate.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureCustomCloudConfig">AzureCustomCloudConfig
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureCustomCloudConfig specifies custom cloud configuration for private Azure environments
- IMPORTANT: Custom cloud configuration is ONLY supported when UseAzureSDK is true.
- The legacy go-autorest SDK does not support custom cloud endpoints.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>activeDirectoryEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ActiveDirectoryEndpoint is the AAD endpoint for authentication
- Required when using custom cloud configuration</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keyVaultEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeyVaultEndpoint is the Key Vault service endpoint</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keyVaultDNSSuffix</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeyVaultDNSSuffix is the DNS suffix for Key Vault URLs</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resourceManagerEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ResourceManagerEndpoint is the Azure Resource Manager endpoint</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureEnvironmentType">AzureEnvironmentType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AzureKVProvider">AzureKVProvider</a>,
- <a href="#generators.external-secrets.io/v1alpha1.ACRAccessTokenSpec">ACRAccessTokenSpec</a>)
- </p>
- <p>
- <p>AzureEnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default, it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud, AzureStackCloud</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"AzureStackCloud"</p></td>
- <td></td>
- </tr><tr><td><p>"ChinaCloud"</p></td>
- <td></td>
- </tr><tr><td><p>"GermanCloud"</p></td>
- <td></td>
- </tr><tr><td><p>"PublicCloud"</p></td>
- <td></td>
- </tr><tr><td><p>"USGovernmentCloud"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureKVAuth">AzureKVAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureKVAuth is the configuration used to authenticate with Azure.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure clientId of the service principle or managed identity used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure tenantId of the managed identity used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure ClientSecret of the service principle used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientCertificate</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure ClientCertificate of the service principle used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.AzureKVProvider">AzureKVProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AzureKVProvider configures a store to sync secrets using Azure KV.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authType</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureAuthType">
- AzureAuthType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth type defines how to authenticate to the keyvault service.
- Valid values are:
- - “ServicePrincipal” (default): Using a service principal (tenantId, clientId, clientSecret)
- - “ManagedIdentity”: Using Managed Identity assigned to the pod (see aad-pod-identity)
- - “WorkloadIdentity”: Using a Kubernetes ServiceAccount federated with Entra ID</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault Url from which the secrets to be fetched from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentType</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureEnvironmentType">
- AzureEnvironmentType
- </a>
- </em>
- </td>
- <td>
- <p>EnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud, AzureStackCloud
- Use AzureStackCloud when you need to configure custom Azure Stack Hub or Azure Stack Edge endpoints.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authSecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureKVAuth">
- AzureKVAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specified the service account
- that should be used when authenticating with WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>If multiple Managed Identity is assigned to the pod, you can select the one to be used</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>useAzureSDK</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UseAzureSDK enables the use of the new Azure SDK for Go (azcore-based) instead of the legacy go-autorest SDK.
- This is experimental and may have behavioral differences. Defaults to false (legacy SDK).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>customCloudConfig</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureCustomCloudConfig">
- AzureCustomCloudConfig
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CustomCloudConfig defines custom Azure endpoints for non-standard clouds.
- Required when EnvironmentType is AzureStackCloud.
- Optional for other environment types - useful for Azure China when using Workload Identity
- with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the
- standard China Cloud endpoint (login.chinacloudapi.cn).
- IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud
- configuration is not supported with the legacy go-autorest SDK.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanAuth">BarbicanAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanProvider">BarbicanProvider</a>)
- </p>
- <p>
- <p>BarbicanAuth contains the authentication information for Barbican.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authType</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanAuthType">
- BarbicanAuthType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AuthType selects how Barbican authenticates.
- - “password”: use username and password.
- - “applicationCredential”: use application credential ID and secret.
- Defaults to “password”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanProviderUsernameRef">
- BarbicanProviderUsernameRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username / Password authentication fields.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>password</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanProviderPasswordRef">
- BarbicanProviderPasswordRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>applicationCredentialID</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanProviderAppCredIDRef">
- BarbicanProviderAppCredIDRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ID of the application credential used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>applicationCredentialSecret</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanProviderAppCredSecretRef">
- BarbicanProviderAppCredSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanAuthType">BarbicanAuthType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanAuth">BarbicanAuth</a>)
- </p>
- <p>
- <p>BarbicanAuthType defines the authentication method used by the Barbican provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"applicationCredential"</p></td>
- <td><p>BarbicanAuthTypeApplicationCredential uses OpenStack Application Credentials.</p>
- </td>
- </tr><tr><td><p>"password"</p></td>
- <td><p>BarbicanAuthTypePassword uses username/password Keystone authentication.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanProvider">BarbicanProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>BarbicanProvider setup a store to sync secrets with barbican.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>domainName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanAuth">
- BarbicanAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanProviderAppCredIDRef">BarbicanProviderAppCredIDRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanAuth">BarbicanAuth</a>)
- </p>
- <p>
- <p>BarbicanProviderAppCredIDRef defines a reference to an Application Credential ID.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanProviderAppCredSecretRef">BarbicanProviderAppCredSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanAuth">BarbicanAuth</a>)
- </p>
- <p>
- <p>BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanProviderPasswordRef">BarbicanProviderPasswordRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanAuth">BarbicanAuth</a>)
- </p>
- <p>
- <p>BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BarbicanProviderUsernameRef">BarbicanProviderUsernameRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BarbicanAuth">BarbicanAuth</a>)
- </p>
- <p>
- <p>BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondTrustProviderSecretRef">BeyondTrustProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustAuth">BeyondtrustAuth</a>)
- </p>
- <p>
- <p>BeyondTrustProviderSecretRef references a value that can be specified directly or via a secret
- for a BeyondTrustProvider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustAuth">BeyondtrustAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustProvider">BeyondtrustProvider</a>)
- </p>
- <p>
- <p>BeyondtrustAuth provides different ways to authenticate to a BeyondtrustProvider server.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>APIKey If not provided then ClientID/ClientSecret become required.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientID is the API OAuth Client ID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientSecret is the API OAuth Client Secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>certificate</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>certificateKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Certificate private key (key.pem). For use when authenticating with an OAuth client Id</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustProvider">BeyondtrustProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>BeyondtrustProvider provides access to a BeyondTrust secrets provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustAuth">
- BeyondtrustAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the operator authenticates with Beyondtrust.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustServer">
- BeyondtrustServer
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how API server works.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustServer">BeyondtrustServer
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustProvider">BeyondtrustProvider</a>)
- </p>
- <p>
- <p>BeyondtrustServer configures a store to sync secrets using BeyondTrust Password Safe.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrievalType</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>separator</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A character that separates the folder names.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decrypt</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>When true, the response includes the decrypted password. When false, the password field is omitted. This option only applies to the SECRET retrieval type. Default: true.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>verifyCA</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientTimeOutSeconds</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustWorkloadCredentialsAuth">BeyondtrustWorkloadCredentialsAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">BeyondtrustWorkloadCredentialsProvider</a>)
- </p>
- <p>
- <p>BeyondtrustWorkloadCredentialsAuth defines the authentication method for the BeyondTrust Workload Credentials provider.
- Currently supports API key authentication via Kubernetes secret reference.
- For authentication documentation, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apikey</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsAuthSecretRef">
- BeyondtrustWorkloadCredentialsAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>APIKey configures API token authentication for BeyondTrust Workload Credentials.
- The token is retrieved from a Kubernetes secret and used as a Bearer token for API requests.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustWorkloadCredentialsAuthSecretRef">BeyondtrustWorkloadCredentialsAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsAuth">BeyondtrustWorkloadCredentialsAuth</a>)
- </p>
- <p>
- <p>BeyondtrustWorkloadCredentialsAuthSecretRef defines a reference to a secret containing credentials for the BeyondTrust Workload Credentials provider.
- The nested structure supports multiple authentication methods (currently only API token is supported).
- For more information on authentication, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Token references the Kubernetes secret containing the BeyondTrust Workload Credentials API token.
- The secret should contain the API key used to authenticate with BeyondTrust Workload Credentials.
- Create an API token in your BeyondTrust Workload Credentials console and store it in a Kubernetes secret.
- For details on creating API tokens, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">BeyondtrustWorkloadCredentialsProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>,
- <a href="#generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecretSpec">BeyondtrustWorkloadCredentialsDynamicSecretSpec</a>)
- </p>
- <p>
- <p>BeyondtrustWorkloadCredentialsProvider configures a store to sync secrets using the BeyondTrust Workload Credentials provider.
- BeyondTrust Workload Credentials provides secure storage for static secrets and dynamic credential generation.
- This provider supports reading secrets and generating dynamic credentials (e.g., temporary AWS credentials).
- For complete documentation, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsAuth">
- BeyondtrustWorkloadCredentialsAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the BeyondTrust Workload Credentials API.
- Currently supports API key authentication via Kubernetes secret reference.
- For authentication setup, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsServer">
- BeyondtrustWorkloadCredentialsServer
- </a>
- </em>
- </td>
- <td>
- <p>Server configures the BeyondTrust Workload Credentials server connection details.
- Includes the API URL and Site ID for your BeyondTrust instance.
- For API reference, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>folderPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>FolderPath specifies the default folder path for secret retrieval.
- Secrets will be fetched from this folder unless overridden in the ExternalSecret spec.
- Example: “production/database” or “dev/api-keys”
- Leave empty to retrieve secrets from the root folder.
- For folder organization, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#folders">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#folders</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a base64-encoded CA certificate used to validate the BeyondTrust Workload Credentials API TLS certificate.
- Use this when your BeyondTrust instance uses a self-signed certificate or internal CA.
- If not set, the system’s trusted root certificates are used.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CAProvider points to a Secret or ConfigMap containing a PEM-encoded CA certificate.
- This is used to validate the BeyondTrust Workload Credentials API TLS certificate.
- Use this as an alternative to CABundle when you want to reference an existing Kubernetes resource.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BeyondtrustWorkloadCredentialsServer">BeyondtrustWorkloadCredentialsServer
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">BeyondtrustWorkloadCredentialsProvider</a>)
- </p>
- <p>
- <p>BeyondtrustWorkloadCredentialsServer defines connection configuration for BeyondTrust Workload Credentials.
- For API reference documentation, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the base URL of your BeyondTrust Workload Credentials API server.
- This should be the full URL to your BeyondTrust instance.
- Example: <a href="https://api.beyondtrust.io/siie">https://api.beyondtrust.io/siie</a>
- For more information, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api#base-url">https://docs.beyondtrust.com/bt-docs/docs/secrets-api#base-url</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>siteId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SiteID is your BeyondTrust Workload Credentials site identifier (UUID format).
- This identifier is unique to your BeyondTrust Workload Credentials instance.
- You can find your Site ID in the BeyondTrust Workload Credentials admin console.
- Example: a1b2c3d4-e5f6-4890-abcd-ef1234567890
- For more information, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BitwardenSecretsManagerAuth">BitwardenSecretsManagerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerAuth contains the ref to the secret that contains the machine account token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerSecretRef">
- BitwardenSecretsManagerSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerProvider configures a store to sync secrets with a Bitwarden Secrets Manager instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>identityURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>bitwardenServerSDKURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
- can be performed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organizationID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>OrganizationID determines which organization this secret store manages.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID determines which project this secret store manages.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerAuth">
- BitwardenSecretsManagerAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a bitwarden machine account instance.
- Make sure that the token being used has permissions on the given secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.BitwardenSecretsManagerSecretRef">BitwardenSecretsManagerSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerAuth">BitwardenSecretsManagerAuth</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credentials</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AccessToken used for the bitwarden instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ByID">ByID
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.FetchingPolicy">FetchingPolicy</a>)
- </p>
- <p>
- <p>ByID configures the provider to interpret the <code>data.secretKey.remoteRef.key</code> field in ExternalSecret as secret ID.</p>
- </p>
- <h3 id="external-secrets.io/v1.ByName">ByName
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.FetchingPolicy">FetchingPolicy</a>)
- </p>
- <p>
- <p>ByName configures the provider to interpret the <code>data.secretKey.remoteRef.key</code> field in ExternalSecret as secret name.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>folderID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The folder to fetch secrets from</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CAProvider">CAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AkeylessProvider">AkeylessProvider</a>,
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">BeyondtrustWorkloadCredentialsProvider</a>,
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider</a>,
- <a href="#external-secrets.io/v1.ConjurProvider">ConjurProvider</a>,
- <a href="#external-secrets.io/v1.GitlabProvider">GitlabProvider</a>,
- <a href="#external-secrets.io/v1.InfisicalProvider">InfisicalProvider</a>,
- <a href="#external-secrets.io/v1.KubernetesServer">KubernetesServer</a>,
- <a href="#external-secrets.io/v1.OpenBaoProvider">OpenBaoProvider</a>,
- <a href="#external-secrets.io/v1.OvhClientMTLS">OvhClientMTLS</a>,
- <a href="#external-secrets.io/v1.PassboltProvider">PassboltProvider</a>,
- <a href="#external-secrets.io/v1.SecretServerProvider">SecretServerProvider</a>,
- <a href="#external-secrets.io/v1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>CAProvider provides a custom certificate authority for accessing the provider’s store.
- The CAProvider points to a Secret or ConfigMap resource that contains a PEM-encoded certificate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProviderType">
- CAProviderType
- </a>
- </em>
- </td>
- <td>
- <p>The type of provider to use such as “Secret”, or “ConfigMap”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the object located at the provider type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the CA certificate can be found in the Secret or ConfigMap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The namespace the Provider type is in.
- Can only be defined when used in a ClusterSecretStore.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CAProviderType">CAProviderType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CAProvider">CAProvider</a>)
- </p>
- <p>
- <p>CAProviderType defines the type of provider for certificate authority.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ConfigMap"</p></td>
- <td><p>CAProviderTypeConfigMap indicates that the CA certificate is stored in a ConfigMap resource.</p>
- </td>
- </tr><tr><td><p>"Secret"</p></td>
- <td><p>CAProviderTypeSecret indicates that the CA certificate is stored in a Secret resource.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.CRDProvider">CRDProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>CRDProvider configures a store to fetch data from arbitrary Kubernetes
- resources, including both custom resources (CRDs) and core API resources
- (e.g. ConfigMap, addressed by setting resource.group to “”). Kubernetes
- Secrets are intentionally blocked; use the Kubernetes provider for those.</p>
- <h1>Authentication modes</h1>
- <p>In-cluster: set auth.serviceAccount and omit server. The server URL defaults
- to the in-cluster API (kubernetes.default) and the controller mints a
- short-lived token for the referenced ServiceAccount to read CRDs locally.</p>
- <p>Remote cluster: set server plus auth (serviceAccount, token, or cert) or
- authRef (a kubeconfig Secret), exactly like the Kubernetes provider.</p>
- <h1>Remote reference keys</h1>
- <ul>
- <li>SecretStore: the key is the object name only; ‘/’ is not allowed. The API
- namespace is always the store namespace, never part of the key.</li>
- <li>ClusterSecretStore: use “namespace/objectName” to read a namespaced CR;
- a key without ‘/’ addresses a cluster-scoped CR by object name. For
- dataFrom Find with a namespaced kind, listing spans all namespaces and
- result keys are “namespace/objectName”.</li>
- </ul>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesServer">
- KubernetesServer
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Server configures the Kubernetes API address and TLS trust, same as the
- Kubernetes provider. When omitted, the URL defaults to the in-cluster API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesAuth">
- KubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures authentication to the Kubernetes API, same as the
- Kubernetes provider. Required when Server.URL is set (unless using AuthRef).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AuthRef references a Secret containing a kubeconfig. Same semantics as the
- Kubernetes provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resource</code></br>
- <em>
- <a href="#external-secrets.io/v1.CRDProviderResource">
- CRDProviderResource
- </a>
- </em>
- </td>
- <td>
- <p>Resource identifies the CRD by its API group, version and kind.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>whitelist</code></br>
- <em>
- <a href="#external-secrets.io/v1.CRDProviderWhitelist">
- CRDProviderWhitelist
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Whitelist optionally restricts which object names and requested properties
- are allowed to be read.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CRDProviderResource">CRDProviderResource
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CRDProvider">CRDProvider</a>)
- </p>
- <p>
- <p>CRDProviderResource identifies a Kubernetes resource (CRD or core) by its
- full API coordinates: group, version and kind.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>group</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Group is the API group of the resource. Use “” (empty string) for core
- Kubernetes resources such as ConfigMap; use e.g. “config.example.io”
- for a CRD. The field is required to be present in the manifest — write
- <code>group: ""</code> explicitly for core resources so typos fail at admission
- time rather than later at discovery.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Version is the API version of the resource (e.g. “v1alpha1”).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Kind is the Kubernetes resource kind (e.g. “MyCustomResource”).</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CRDProviderWhitelist">CRDProviderWhitelist
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CRDProvider">CRDProvider</a>)
- </p>
- <p>
- <p>CRDProviderWhitelist configures allow-list rules for CRD reads.
- If any rules are present, a request must satisfy ALL non-empty filters of at
- least one rule; requests that match no rule are denied.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>rules</code></br>
- <em>
- <a href="#external-secrets.io/v1.CRDProviderWhitelistRule">
- []CRDProviderWhitelistRule
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Rules is a list of allow rules. If rules are set, at least one rule must
- match for a request to be allowed.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CRDProviderWhitelistRule">CRDProviderWhitelistRule
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CRDProviderWhitelist">CRDProviderWhitelist</a>)
- </p>
- <p>
- <p>CRDProviderWhitelistRule defines a single allow rule for CRD reads.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name is an optional regular expression matched against the bare object name.
- For both SecretStore and ClusterSecretStore this is always the object name
- without any namespace prefix (e.g. “my-db-spec”, not “prod/my-db-spec”).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Namespace is an optional regular expression matched against the namespace of
- the object. Applies only when a ClusterSecretStore is used; it is ignored
- for SecretStore (where the namespace is fixed to the store namespace).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>properties</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Properties is an optional list of regular expressions matched against
- requested property keys (for example: “spec.secretValue”).</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CSMAuth">CSMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CloudruSMProvider">CloudruSMProvider</a>)
- </p>
- <p>
- <p>CSMAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.CSMAuthSecretRef">
- CSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CSMAuthSecretRef">CSMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CSMAuth">CSMAuth</a>)
- </p>
- <p>
- <p>CSMAuthSecretRef holds secret references for Cloud.ru credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessKeySecretSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeySecret is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CacheConfig">CacheConfig
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnePasswordSDKProvider">OnePasswordSDKProvider</a>)
- </p>
- <p>
- <p>CacheConfig configures client-side caching for read operations.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>ttl</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TTL is the time-to-live for cached secrets.
- Format: duration string (e.g., “5m”, “1h”, “30s”)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>maxSize</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>MaxSize is the maximum number of secrets to cache.
- When the cache is full, least-recently-used entries are evicted.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CertAuth">CertAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.KubernetesAuth">KubernetesAuth</a>)
- </p>
- <p>
- <p>CertAuth defines certificate-based authentication configuration for Kubernetes.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientCert</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ChefAuth">ChefAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ChefProvider">ChefProvider</a>)
- </p>
- <p>
- <p>ChefAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.ChefAuthSecretRef">
- ChefAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ChefAuthSecretRef">ChefAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ChefAuth">ChefAuth</a>)
- </p>
- <p>
- <p>ChefAuthSecretRef holds secret references for chef server login credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privateKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretKey is the Signing Key in PEM format, used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ChefProvider">ChefProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ChefProvider configures a store to sync secrets using basic chef server connection credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.ChefAuth">
- ChefAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against chef Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>UserName should be the user ID on the chef server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serverUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a “/”</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.CloudruSMProvider">CloudruSMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>CloudruSMProvider configures a store to sync secrets using the Cloud.ru Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.CSMAuth">
- CSMAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID is the project, which the secrets are stored in.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecret">ClusterExternalSecret
- </h3>
- <p>
- <p>ClusterExternalSecret is the Schema for the clusterexternalsecrets API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretSpec">
- ClusterExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>externalSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>The spec for the ExternalSecrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the external secrets to be created.
- Defaults to the name of the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretMetadata">
- ExternalSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The labels to select by to find the Namespaces to create the ExternalSecrets in.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretStatus">
- ClusterExternalSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecretConditionType">ClusterExternalSecretConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretStatusCondition">ClusterExternalSecretStatusCondition</a>)
- </p>
- <p>
- <p>ClusterExternalSecretConditionType defines a value type for ClusterExternalSecret conditions.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>ClusterExternalSecretReady is a ClusterExternalSecretConditionType set when the ClusterExternalSecret is ready.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecretNamespaceFailure">ClusterExternalSecretNamespaceFailure
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretStatus">ClusterExternalSecretStatus</a>)
- </p>
- <p>
- <p>ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it’s reason.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Namespace is the namespace that failed when trying to apply an ExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reason is why the ExternalSecret failed to apply to the namespace</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecretSpec">ClusterExternalSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecret">ClusterExternalSecret</a>)
- </p>
- <p>
- <p>ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>externalSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>The spec for the ExternalSecrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the external secrets to be created.
- Defaults to the name of the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretMetadata">
- ExternalSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The labels to select by to find the Namespaces to create the ExternalSecrets in.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecretStatus">ClusterExternalSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecret">ClusterExternalSecret</a>)
- </p>
- <p>
- <p>ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ExternalSecretName is the name of the ExternalSecrets created by the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>failedNamespaces</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretNamespaceFailure">
- []ClusterExternalSecretNamespaceFailure
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Failed namespaces are the namespaces that failed to apply an ExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provisionedNamespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretStatusCondition">
- []ClusterExternalSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterExternalSecretStatusCondition">ClusterExternalSecretStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretStatus">ClusterExternalSecretStatus</a>)
- </p>
- <p>
- <p>ClusterExternalSecretStatusCondition defines the observed state of a ClusterExternalSecret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretConditionType">
- ClusterExternalSecretConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterSecretStore">ClusterSecretStore
- </h3>
- <p>
- <p>ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of <code>storeRef</code> fields.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreSpec">
- SecretStoreSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- k8s.io/apimachinery/pkg/util/intstr.IntOrString
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval. Accepts either an integer number
- of seconds (legacy) or a Go duration string such as “1h” or “5m”. Empty or
- 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreStatus">
- SecretStoreStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ClusterSecretStoreCondition">ClusterSecretStoreCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreSpec">SecretStoreSpec</a>)
- </p>
- <p>
- <p>ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
- for a ClusterSecretStore instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespace using a labelSelector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceRegexes</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by using regex matching</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConfigMapReference">ConfigMapReference
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentityFederation">GCPWorkloadIdentityFederation</a>)
- </p>
- <p>
- <p>ConfigMapReference holds the details of a configmap.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>name of the configmap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>namespace in which the configmap exists. If empty, configmap will looked up in local namespace.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>key name holding the external account credential config.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConjurAPIKey">ConjurAPIKey
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ConjurAuth">ConjurAuth</a>)
- </p>
- <p>
- <p>ConjurAPIKey contains references to a Secret resource that holds
- the Conjur username and API key.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>account</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Account is the Conjur organization account name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>userRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>A reference to a specific ‘key’ containing the Conjur username
- within a Secret resource. In some instances, <code>key</code> is a required field.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiKeyRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>A reference to a specific ‘key’ containing the Conjur API key
- within a Secret resource. In some instances, <code>key</code> is a required field.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConjurAuth">ConjurAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ConjurProvider">ConjurProvider</a>)
- </p>
- <p>
- <p>ConjurAuth is the way to provide authentication credentials to the ConjurProvider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apikey</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConjurAPIKey">
- ConjurAPIKey
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Authenticates with Conjur using an API key.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConjurJWT">
- ConjurJWT
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Jwt enables JWT authentication using Kubernetes service account tokens.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cert</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConjurCert">
- ConjurCert
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Cert enables certificate-based authentication using a client certificate and key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConjurCert">ConjurCert
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ConjurAuth">ConjurAuth</a>)
- </p>
- <p>
- <p>ConjurCert defines the Cert authentication configuration for Conjur provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>account</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Account is the Conjur organization account name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The conjur authn cert webservice id</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>hostId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional HostID for cert authentication (can be omitted when using ‘spiffe’ mode).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientCertRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>ClientCertRef is a reference to a specific ‘key’ containing the client certificate
- within a Secret resource. The certificate must be PEM-encoded.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientKeyRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>ClientKeyRef is a reference to a specific ‘key’ containing the private RSA client key
- within a Secret resource. The key must be PEM-encoded.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConjurJWT">ConjurJWT
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ConjurAuth">ConjurAuth</a>)
- </p>
- <p>
- <p>ConjurJWT defines the JWT authentication configuration for Conjur provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>account</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Account is the Conjur organization account name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The conjur authn jwt webservice id</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>hostId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional HostID for JWT authentication. This may be used depending
- on how the Conjur JWT authenticator policy is configured.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional SecretRef that refers to a key in a Secret resource containing JWT token to
- authenticate with Conjur using the JWT authentication method.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional ServiceAccountRef specifies the Kubernetes service account for which to request
- a token for with the <code>TokenRequest</code> API.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ConjurProvider">ConjurProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ConjurProvider provides access to a Conjur provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL is the endpoint of the Conjur instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to provide custom certificate authority (CA) certificates
- for a secret store. The CAProvider points to a Secret or ConfigMap resource
- that contains a PEM-encoded certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConjurAuth">
- ConjurAuth
- </a>
- </em>
- </td>
- <td>
- <p>Defines authentication settings for connecting to Conjur.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DVLSAuth">DVLSAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DVLSProvider">DVLSProvider</a>)
- </p>
- <p>
- <p>DVLSAuth defines the authentication method for the DVLS provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.DVLSAuthSecretRef">
- DVLSAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef contains the Application ID and Application Secret for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DVLSAuthSecretRef">DVLSAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DVLSAuth">DVLSAuth</a>)
- </p>
- <p>
- <p>DVLSAuthSecretRef defines the secret references for DVLS authentication credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>appId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AppID is the reference to the secret containing the Application ID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AppSecret is the reference to the secret containing the Application Secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DVLSProvider">DVLSProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>DVLSProvider configures a store to sync secrets using Devolutions Server.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serverUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServerURL is the DVLS instance URL (e.g., <a href="https://dvls.example.com">https://dvls.example.com</a>).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Vault is the name or UUID of the vault to fetch secrets from.
- When omitted, the vault must be specified in the secret key using the legacy format “<vault-id>/<entry-id>”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>insecure</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Insecure allows connecting to DVLS over plain HTTP.
- This is NOT RECOMMENDED for production use.
- Set to true only if you understand the security implications.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.DVLSAuth">
- DVLSAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the authentication method to use.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DelineaProvider">DelineaProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>DelineaProvider provides access to Delinea secrets vault Server.
- See: <a href="https://github.com/DelineaXPM/dsv-sdk-go/blob/main/vault/vault.go">https://github.com/DelineaXPM/dsv-sdk-go/blob/main/vault/vault.go</a>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="#external-secrets.io/v1.DelineaProviderSecretRef">
- DelineaProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientID is the non-secret part of the credential.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="#external-secrets.io/v1.DelineaProviderSecretRef">
- DelineaProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientSecret is the secret part of the credential.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenant</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Tenant is the chosen hostname / site name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>urlTemplate</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>URLTemplate
- If unset, defaults to “https://%s.secretsvaultcloud.%s/v1/%s%s”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tld</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TLD is based on the server location that was chosen during provisioning.
- If unset, defaults to “com”.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DelineaProviderSecretRef">DelineaProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DelineaProvider">DelineaProvider</a>)
- </p>
- <p>
- <p>DelineaProviderSecretRef is a secret reference containing either a direct value or a reference to a secret key.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DopplerAuth">DopplerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DopplerProvider">DopplerProvider</a>)
- </p>
- <p>
- <p>DopplerAuth configures authentication with the Doppler API.
- Exactly one of secretRef or oidcConfig must be specified.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.DopplerAuthSecretRef">
- DopplerAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef authenticates using a Doppler service token stored in a Kubernetes Secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>oidcConfig</code></br>
- <em>
- <a href="#external-secrets.io/v1.DopplerOIDCAuth">
- DopplerOIDCAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DopplerAuthSecretRef">DopplerAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DopplerAuth">DopplerAuth</a>)
- </p>
- <p>
- <p>DopplerAuthSecretRef contains the secret reference for accessing the Doppler API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>dopplerToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The DopplerToken is used for authentication.
- See <a href="https://docs.doppler.com/reference/api#authentication">https://docs.doppler.com/reference/api#authentication</a> for auth token types.
- The Key attribute defaults to dopplerToken if not specified.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DopplerOIDCAuth">DopplerOIDCAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.DopplerAuth">DopplerAuth</a>)
- </p>
- <p>
- <p>DopplerOIDCAuth configures OIDC authentication with Doppler using Kubernetes ServiceAccount tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identity</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Identity is the Doppler Service Account Identity ID configured for OIDC authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expirationSeconds</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpirationSeconds sets the ServiceAccount token validity duration.
- Defaults to 10 minutes.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.DopplerProvider">DopplerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>DopplerProvider configures a store to sync secrets using the Doppler provider.
- Project and Config are required if not using a Service Token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.DopplerAuth">
- DopplerAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Doppler API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler project (required if not using a Service Token)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>config</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler config (required if not using a Service Token)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>nameTransformer</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Environment variable compatible name transforms that change secret names to a different format</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>format</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Format enables the downloading of secrets as a file (string)</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecret">ExternalSecret
- </h3>
- <p>
- <p>ExternalSecret is the Schema for the external-secrets API.
- It defines how to fetch data from external APIs and make it available as Kubernetes Secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>secretStoreRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">
- ExternalSecretTarget
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRefreshPolicy">
- ExternalSecretRefreshPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RefreshPolicy determines how the ExternalSecret should be refreshed:
- - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
- - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
- No periodic updates occur if refreshInterval is 0.
- - OnChange: Only synchronizes the Secret when the ExternalSecret’s metadata or specification changes</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
- specified as Golang Duration strings.
- Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”
- Example values: “1h0m0s”, “2h30m0s”, “10m0s”
- May be set to “0s” to fetch and create it once. Defaults to 1h0m0s.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncWindows</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindows">
- ExternalSecretSyncWindows
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SyncWindows optionally restricts when periodic refreshes may occur.
- Evaluated in UTC, only for Periodic refresh policy (or when refreshPolicy is unset).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretData">
- []ExternalSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Data defines the connection between the Kubernetes Secret keys and the Provider data</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">
- []ExternalSecretDataFromRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataFrom is used to fetch all properties from a specific Provider data
- If multiple entries are specified, the Secret keys are merged in the specified order</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretStatus">
- ExternalSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretConditionType">ExternalSecretConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretStatusCondition">ExternalSecretStatusCondition</a>)
- </p>
- <p>
- <p>ExternalSecretConditionType defines a value type for ExternalSecret conditions.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Deleted"</p></td>
- <td><p>ExternalSecretDeleted indicates that the external secret has been deleted.</p>
- </td>
- </tr><tr><td><p>"Ready"</p></td>
- <td><p>ExternalSecretReady indicates that the external secret is ready and synced.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretConversionStrategy">ExternalSecretConversionStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>,
- <a href="#external-secrets.io/v1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>ExternalSecretConversionStrategy defines strategies for converting secret values.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Default"</p></td>
- <td><p>ExternalSecretConversionDefault specifies the default conversion strategy.</p>
- </td>
- </tr><tr><td><p>"Unicode"</p></td>
- <td><p>ExternalSecretConversionUnicode specifies that values should be treated as Unicode.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretCreationPolicy">ExternalSecretCreationPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"CreateOrMerge"</p></td>
- <td><p>CreatePolicyCreateOrMerge creates the Secret if it is missing and merges
- data fields into it if it exists, without an ownerReference. A deleted
- target is recreated while the ExternalSecret exists, and the Secret is
- retained when the ExternalSecret is deleted.</p>
- </td>
- </tr><tr><td><p>"Merge"</p></td>
- <td><p>CreatePolicyMerge does not create the Secret, but merges the data fields to the Secret.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>CreatePolicyNone does not create a Secret (future use with injector).</p>
- </td>
- </tr><tr><td><p>"Orphan"</p></td>
- <td><p>CreatePolicyOrphan creates the Secret and does not set the ownerReference.
- I.e. it will be orphaned after the deletion of the ExternalSecret.</p>
- </td>
- </tr><tr><td><p>"Owner"</p></td>
- <td><p>CreatePolicyOwner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretData">ExternalSecretData
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key in the Kubernetes Secret to store the value.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">
- ExternalSecretDataRemoteRef
- </a>
- </em>
- </td>
- <td>
- <p>RemoteRef points to the remote secret and defines
- which secret (version/property/..) to fetch.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sourceRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.StoreSourceRef">
- StoreSourceRef
- </a>
- </em>
- </td>
- <td>
- <p>SourceRef allows you to override the source
- from which the value will be pulled.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretDataFromRemoteRef defines the connection between the Kubernetes Secret keys and the Provider data
- when using DataFrom to fetch multiple values from a Provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>extract</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">
- ExternalSecretDataRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to extract multiple key/value pairs from one secret
- Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>find</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretFind">
- ExternalSecretFind
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to find secrets based on tags or regular expressions
- Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>rewrite</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewrite">
- []ExternalSecretRewrite
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to rewrite secret Keys after getting them from the secret Provider
- Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sourceRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.StoreGeneratorSourceRef">
- StoreGeneratorSourceRef
- </a>
- </em>
- </td>
- <td>
- <p>SourceRef points to a store or generator
- which contains secret values ready to use.
- Use this in combination with Extract or Find pull values out of
- a specific SecretStore.
- When sourceRef points to a generator Extract or Find is not supported.
- The generator returns a static map of values</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretData">ExternalSecretData</a>,
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretDataRemoteRef defines Provider data location.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Key is the key used in the Provider, mandatory</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadataPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretMetadataPolicy">
- ExternalSecretMetadataPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>property</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select a specific property of the Provider value (if a map), if supported</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select a specific version of the Provider value, if supported</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretConversionStrategy">
- ExternalSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy. Defaults to Default when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decodingStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDecodingStrategy">
- ExternalSecretDecodingStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a decoding Strategy. Defaults to None when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>nullBytePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretNullBytePolicy">
- ExternalSecretNullBytePolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Controls how ESO handles fetched secret data containing NUL bytes for this source.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretDecodingStrategy">ExternalSecretDecodingStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>,
- <a href="#external-secrets.io/v1.ExternalSecretFind">ExternalSecretFind</a>,
- <a href="#external-secrets.io/v1.TemplateFrom">TemplateFrom</a>)
- </p>
- <p>
- <p>ExternalSecretDecodingStrategy defines strategies for decoding secret values.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Auto"</p></td>
- <td><p>ExternalSecretDecodeAuto specifies automatic detection of the decoding method.</p>
- </td>
- </tr><tr><td><p>"Base64"</p></td>
- <td><p>ExternalSecretDecodeBase64 specifies that values should be decoded using Base64.</p>
- </td>
- </tr><tr><td><p>"Base64URL"</p></td>
- <td><p>ExternalSecretDecodeBase64URL specifies that values should be decoded using Base64URL.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>ExternalSecretDecodeNone specifies that no decoding should be performed.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretDeletionPolicy">ExternalSecretDeletionPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ExternalSecretDeletionPolicy defines rules on how to delete the resulting Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Delete"</p></td>
- <td><p>DeletionPolicyDelete deletes the secret if all provider secrets are deleted.
- If a secret gets deleted on the provider side and is not accessible
- anymore this is not considered an error and the ExternalSecret
- does not go into SecretSyncedError status.</p>
- </td>
- </tr><tr><td><p>"Merge"</p></td>
- <td><p>DeletionPolicyMerge removes keys in the secret, but not the secret itself.
- If a secret gets deleted on the provider side and is not accessible
- anymore this is not considered an error and the ExternalSecret
- does not go into SecretSyncedError status.</p>
- </td>
- </tr><tr><td><p>"Retain"</p></td>
- <td><p>DeletionPolicyRetain will retain the secret if all provider secrets have been deleted.
- If a provider secret does not exist the ExternalSecret gets into the
- SecretSyncedError status.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretFind">ExternalSecretFind
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretFind defines configuration for finding secrets in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A root path to start the find operations.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- <a href="#external-secrets.io/v1.FindName">
- FindName
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Finds secrets based on the name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tags</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Find secrets based on tags.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretConversionStrategy">
- ExternalSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy. Defaults to Default when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decodingStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDecodingStrategy">
- ExternalSecretDecodingStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a decoding Strategy. Defaults to None when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>nullBytePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretNullBytePolicy">
- ExternalSecretNullBytePolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Controls how ESO handles fetched secret data containing NUL bytes for this find source.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretMetadata">ExternalSecretMetadata
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretSpec">ClusterExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretMetadata defines metadata fields for the ExternalSecret generated by the ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>annotations</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>labels</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretMetadataPolicy">ExternalSecretMetadataPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretMetadataPolicy defines policies for fetching metadata from provider secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Fetch"</p></td>
- <td><p>ExternalSecretMetadataPolicyFetch specifies that metadata should be fetched from the provider.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>ExternalSecretMetadataPolicyNone specifies that no metadata should be fetched from the provider.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretNullBytePolicy">ExternalSecretNullBytePolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>,
- <a href="#external-secrets.io/v1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>ExternalSecretNullBytePolicy defines how fetched secret data containing NUL bytes should be handled.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Fail"</p></td>
- <td><p>ExternalSecretNullBytePolicyFail fails reconciliation if fetched secret data contains NUL bytes.</p>
- </td>
- </tr><tr><td><p>"Ignore"</p></td>
- <td><p>ExternalSecretNullBytePolicyIgnore allows fetched secret data to contain NUL bytes.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRefreshPolicy">ExternalSecretRefreshPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretRefreshPolicy defines how and when the ExternalSecret should be refreshed.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"CreatedOnce"</p></td>
- <td><p>RefreshPolicyCreatedOnce creates the Secret once and does not update it thereafter.</p>
- </td>
- </tr><tr><td><p>"OnChange"</p></td>
- <td><p>RefreshPolicyOnChange only synchronizes when the ExternalSecret’s metadata or spec changes.</p>
- </td>
- </tr><tr><td><p>"Periodic"</p></td>
- <td><p>RefreshPolicyPeriodic synchronizes the Secret from the provider at regular intervals.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewrite">ExternalSecretRewrite
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretRewrite defines how to rewrite secret data values before they are written to the Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>merge</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMerge">
- ExternalSecretRewriteMerge
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to merge key/values in one single Secret
- The resulting key will contain all values from the specified secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteRegexp">
- ExternalSecretRewriteRegexp
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to rewrite with regular expressions.
- The resulting key will be the output of a regexp.ReplaceAll operation.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>transform</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteTransform">
- ExternalSecretRewriteTransform
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to apply string transformation on the secrets.
- The resulting key will be the output of the template applied by the operation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteMerge">ExternalSecretRewriteMerge
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewrite">ExternalSecretRewrite</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteMerge defines configuration for merging secret values.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>into</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define the target key of the merge operation.
- Required if strategy is JSON. Ignored otherwise.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>priority</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define key priority in conflict resolution.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>priorityPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMergePriorityPolicy">
- ExternalSecretRewriteMergePriorityPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define the policy when a key in the priority list does not exist in the input.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conflictPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMergeConflictPolicy">
- ExternalSecretRewriteMergeConflictPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define the policy to use in conflict resolution.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>strategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMergeStrategy">
- ExternalSecretRewriteMergeStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define the strategy to use in the merge operation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteMergeConflictPolicy">ExternalSecretRewriteMergeConflictPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMerge">ExternalSecretRewriteMerge</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteMergeConflictPolicy defines the policy for resolving conflicts when merging secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Error"</p></td>
- <td><p>ExternalSecretRewriteMergeConflictPolicyError returns an error when conflicts occur during merge.</p>
- </td>
- </tr><tr><td><p>"Ignore"</p></td>
- <td><p>ExternalSecretRewriteMergeConflictPolicyIgnore ignores conflicts when merging secret values.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteMergePriorityPolicy">ExternalSecretRewriteMergePriorityPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMerge">ExternalSecretRewriteMerge</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteMergePriorityPolicy defines the policy for handling missing keys in the priority
- list during merge operations.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"IgnoreNotFound"</p></td>
- <td></td>
- </tr><tr><td><p>"Strict"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteMergeStrategy">ExternalSecretRewriteMergeStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteMerge">ExternalSecretRewriteMerge</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteMergeStrategy defines the strategy for merging secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Extract"</p></td>
- <td><p>ExternalSecretRewriteMergeStrategyExtract merges secrets by extracting values.</p>
- </td>
- </tr><tr><td><p>"JSON"</p></td>
- <td><p>ExternalSecretRewriteMergeStrategyJSON merges secrets using JSON merge strategy.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteRegexp">ExternalSecretRewriteRegexp
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewrite">ExternalSecretRewrite</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretRewrite">PushSecretRewrite</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteRegexp defines configuration for rewriting secrets using regular expressions.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>source</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the regular expression of a re.Compiler.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the target pattern of a ReplaceAll operation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretRewriteTransform">ExternalSecretRewriteTransform
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretRewrite">ExternalSecretRewrite</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretRewrite">PushSecretRewrite</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteTransform defines configuration for transforming secrets using templates.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the template to apply on the secret name.
- <code>.value</code> will specify the secret name in the template.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterExternalSecretSpec">ClusterExternalSecretSpec</a>,
- <a href="#external-secrets.io/v1.ExternalSecret">ExternalSecret</a>)
- </p>
- <p>
- <p>ExternalSecretSpec defines the desired state of ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretStoreRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">
- ExternalSecretTarget
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRefreshPolicy">
- ExternalSecretRefreshPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RefreshPolicy determines how the ExternalSecret should be refreshed:
- - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
- - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
- No periodic updates occur if refreshInterval is 0.
- - OnChange: Only synchronizes the Secret when the ExternalSecret’s metadata or specification changes</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
- specified as Golang Duration strings.
- Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”
- Example values: “1h0m0s”, “2h30m0s”, “10m0s”
- May be set to “0s” to fetch and create it once. Defaults to 1h0m0s.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncWindows</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindows">
- ExternalSecretSyncWindows
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SyncWindows optionally restricts when periodic refreshes may occur.
- Evaluated in UTC, only for Periodic refresh policy (or when refreshPolicy is unset).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretData">
- []ExternalSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Data defines the connection between the Kubernetes Secret keys and the Provider data</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">
- []ExternalSecretDataFromRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataFrom is used to fetch all properties from a specific Provider data
- If multiple entries are specified, the Secret keys are merged in the specified order</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretStatus">ExternalSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecret">ExternalSecret</a>)
- </p>
- <p>
- <p>ExternalSecretStatus defines the observed state of ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>refreshTime is the time and date the external secret was fetched and
- the target secret updated</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncedResourceVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SyncedResourceVersion keeps track of the last synced version</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretStatusCondition">
- []ExternalSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>binding</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#localobjectreference-v1-core">
- Kubernetes core/v1.LocalObjectReference
- </a>
- </em>
- </td>
- <td>
- <p>Binding represents a servicebinding.io Provisioned Service reference to the secret</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretStatusCondition">ExternalSecretStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretStatus">ExternalSecretStatus</a>)
- </p>
- <p>
- <p>ExternalSecretStatusCondition defines a status condition of an ExternalSecret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretConditionType">
- ExternalSecretConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretSyncWindowEntry">ExternalSecretSyncWindowEntry
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindows">ExternalSecretSyncWindows</a>)
- </p>
- <p>
- <p>ExternalSecretSyncWindowEntry defines a single cron-schedule + duration pair
- within a SyncWindows block.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>schedule</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Schedule is a standard 5-field cron expression evaluated in UTC, or a
- named shorthand such as @daily or @every 1h. It marks the start time of
- each window occurrence.
- Example: “0 22 * * 1-5” opens a window every weekday at 22:00 UTC.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>duration</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>Duration specifies how long the window stays open after each Schedule
- firing. Example: “8h”.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretSyncWindowKind">ExternalSecretSyncWindowKind
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindows">ExternalSecretSyncWindows</a>)
- </p>
- <p>
- <p>ExternalSecretSyncWindowKind defines whether a SyncWindow permits or
- blocks periodic refreshes.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"allow"</p></td>
- <td><p>SyncWindowAllow allows periodic refreshes only while at least one window
- in the list is active. Refreshes are blocked at all other times.</p>
- </td>
- </tr><tr><td><p>"deny"</p></td>
- <td><p>SyncWindowDeny blocks periodic refreshes while any window in the list is
- active. Refreshes proceed normally at all other times.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretSyncWindows">ExternalSecretSyncWindows
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretSyncWindows optionally restricts when periodic syncs may occur.
- All windows in the list share the same Kind.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindowKind">
- ExternalSecretSyncWindowKind
- </a>
- </em>
- </td>
- <td>
- <p>Kind applies to every window in the list.
- “allow” – syncs are permitted only while at least one window is active;
- all other times are blocked.
- “deny” – syncs are blocked while any window is active;
- all other times are permitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>windows</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretSyncWindowEntry">
- []ExternalSecretSyncWindowEntry
- </a>
- </em>
- </td>
- <td>
- <p>Windows is the list of schedule+duration pairs.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretTarget">ExternalSecretTarget
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretTarget defines the Kubernetes Secret to be created,
- there can be only one target per ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the Secret resource to be managed.
- Defaults to the .metadata.name of the ExternalSecret resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>creationPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretCreationPolicy">
- ExternalSecretCreationPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CreationPolicy defines rules on how to create the resulting Secret.
- Defaults to “Owner”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>deletionPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDeletionPolicy">
- ExternalSecretDeletionPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DeletionPolicy defines rules on how to delete the resulting Secret.
- Defaults to “Retain”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">
- ExternalSecretTemplate
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Template defines a blueprint for the created Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>manifest</code></br>
- <em>
- <a href="#external-secrets.io/v1.ManifestReference">
- ManifestReference
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Manifest defines a custom Kubernetes resource to create instead of a Secret.
- When specified, ExternalSecret will create the resource type defined here
- (e.g., ConfigMap, Custom Resource) instead of a Secret.
- Warning: Using Generic target. Make sure access policies and encryption are properly configured.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>immutable</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Immutable defines if the final secret will be immutable</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretTemplate">ExternalSecretTemplate
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">ExternalSecretTarget</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretTemplate defines a blueprint for the created Secret resource.
- we can not use native corev1.Secret, it will have empty ObjectMeta values: <a href="https://github.com/kubernetes-sigs/controller-tools/issues/448">https://github.com/kubernetes-sigs/controller-tools/issues/448</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#secrettype-v1-core">
- Kubernetes core/v1.SecretType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>engineVersion</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateEngineVersion">
- TemplateEngineVersion
- </a>
- </em>
- </td>
- <td>
- <p>EngineVersion specifies the template engine version
- that should be used to compile/execute the
- template specified in .data and .templateFrom[].</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplateMetadata">
- ExternalSecretTemplateMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>mergePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateMergePolicy">
- TemplateMergePolicy
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>templateFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateFrom">
- []TemplateFrom
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretTemplateMetadata">ExternalSecretTemplateMetadata
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>annotations</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>labels</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>finalizers</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ExternalSecretValidator">ExternalSecretValidator
- </h3>
- <p>
- <p>ExternalSecretValidator implements a validating webhook for ExternalSecrets.</p>
- </p>
- <h3 id="external-secrets.io/v1.FakeProvider">FakeProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>FakeProvider configures a fake provider that returns static values.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1.FakeProviderData">
- []FakeProviderData
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>validationResult</code></br>
- <em>
- <a href="#external-secrets.io/v1.ValidationResult">
- ValidationResult
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.FakeProviderData">FakeProviderData
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.FakeProvider">FakeProvider</a>)
- </p>
- <p>
- <p>FakeProviderData defines a key-value pair with optional version for the fake provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.FetchingPolicy">FetchingPolicy
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.YandexCertificateManagerProvider">YandexCertificateManagerProvider</a>,
- <a href="#external-secrets.io/v1.YandexLockboxProvider">YandexLockboxProvider</a>)
- </p>
- <p>
- <p>FetchingPolicy configures how the provider interprets the <code>data.secretKey.remoteRef.key</code> field in ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>byID</code></br>
- <em>
- <a href="#external-secrets.io/v1.ByID">
- ByID
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>byName</code></br>
- <em>
- <a href="#external-secrets.io/v1.ByName">
- ByName
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.FindName">FindName
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>FindName defines criteria for finding secrets by name patterns.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Finds secrets base</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.FortanixProvider">FortanixProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>FortanixProvider provides access to Fortanix SDKMS API using the provided credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the URL of SDKMS API. Defaults to <code>sdkms.fortanix.com</code>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.FortanixProviderSecretRef">
- FortanixProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>APIKey is the API token to access SDKMS Applications.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.FortanixProviderSecretRef">FortanixProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.FortanixProvider">FortanixProvider</a>)
- </p>
- <p>
- <p>FortanixProviderSecretRef is a secret reference containing the SDKMS API Key.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef is a reference to a secret containing the SDKMS API Key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GCPSMAuth">GCPSMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPSMProvider">GCPSMProvider</a>)
- </p>
- <p>
- <p>GCPSMAuth defines the authentication methods for Google Cloud Platform Secret Manager.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPSMAuthSecretRef">
- GCPSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentity">
- GCPWorkloadIdentity
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentityFederation</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentityFederation">
- GCPWorkloadIdentityFederation
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GCPSMAuthSecretRef">GCPSMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPSMAuth">GCPSMAuth</a>,
- <a href="#external-secrets.io/v1.VaultGCPAuth">VaultGCPAuth</a>)
- </p>
- <p>
- <p>GCPSMAuthSecretRef contains the secret references for GCP Secret Manager authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GCPSMProvider">GCPSMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GCPSMProvider Configures a store to sync secrets using the GCP Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPSMAuth">
- GCPSMAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines the information necessary to authenticate against GCP</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID project where secret is located</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>location</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Location optionally defines a location for a secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretVersionSelectionPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretVersionSelectionPolicy">
- SecretVersionSelectionPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretVersionSelectionPolicy specifies how the provider selects a secret version
- when “latest” is disabled or destroyed.
- Possible values are:
- - LatestOrFail: the provider always uses “latest”, or fails if that version is disabled/destroyed.
- - LatestOrFetch: the provider falls back to fetching the latest version if the version is DESTROYED or DISABLED</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GCPWorkloadIdentity">GCPWorkloadIdentity
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPSMAuth">GCPSMAuth</a>,
- <a href="#external-secrets.io/v1.VaultGCPAuth">VaultGCPAuth</a>)
- </p>
- <p>
- <p>GCPWorkloadIdentity defines configuration for workload identity authentication to GCP.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterLocation</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterLocation is the location of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterName is the name of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterProjectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterProjectID is the project ID of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GCPWorkloadIdentityFederation">GCPWorkloadIdentityFederation
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPSMAuth">GCPSMAuth</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuth">GCPSMAuth</a>)
- </p>
- <p>
- <p>GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credConfig</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConfigMapReference">
- ConfigMapReference
- </a>
- </em>
- </td>
- <td>
- <p>credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data.
- For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead
- serviceAccountRef must be used by providing operators service account details.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
- when Kubernetes is configured as provider in workload identity pool.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>awsSecurityCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.AwsCredentialsConfig">
- AwsCredentialsConfig
- </a>
- </em>
- </td>
- <td>
- <p>awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token,
- when using the AWS metadata server is not an option.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>audience</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool.
- If specified, Audience found in the external account credential config will be overridden with the configured value.
- audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalTokenEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the
- credential_source.url in the provided credConfig. This field is merely to double-check the external token source
- URL is having the expected value.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcpServiceAccountEmail</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate
- after Workload Identity Federation. Use this to grant access through the service account’s
- IAM bindings (for example roles/secretmanager.secretAccessor). When set, it overrides
- service_account_impersonation_url in the external account JSON from credConfig;
- when serviceAccountRef is set, it also overrides the “iam.gke.io/gcp-service-account” annotation
- on that ServiceAccount.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GcpIDTokenAuthCredentials">GcpIDTokenAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>GcpIDTokenAuthCredentials represents the credentials for GCP ID token authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GcpIamAuthCredentials">GcpIamAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>GcpIamAuthCredentials represents the credentials for GCP IAM authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountKeyFilePath</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GeneratorRef">GeneratorRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.StoreGeneratorSourceRef">StoreGeneratorSourceRef</a>,
- <a href="#external-secrets.io/v1.StoreSourceRef">StoreSourceRef</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretSelector">PushSecretSelector</a>)
- </p>
- <p>
- <p>GeneratorRef points to a generator custom resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the apiVersion of the generator resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the Kind of the generator resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the name of the generator resource</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GenericClusterStoreValidator">GenericClusterStoreValidator
- </h3>
- <p>
- <p>GenericClusterStoreValidator implements webhook validation for ClusterSecretStore resources.</p>
- </p>
- <h3 id="external-secrets.io/v1.GenericStore">GenericStore
- </h3>
- <p>
- <p>GenericStore is a common interface for interacting with ClusterSecretStore
- or a namespaced SecretStore.</p>
- </p>
- <h3 id="external-secrets.io/v1.GenericStoreValidator">GenericStoreValidator
- </h3>
- <p>
- <p>GenericStoreValidator implements webhook validation for SecretStore resources.</p>
- </p>
- <h3 id="external-secrets.io/v1.GithubAppAuth">GithubAppAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GithubProvider">GithubProvider</a>)
- </p>
- <p>
- <p>GithubAppAuth defines authentication configuration using a GitHub App for accessing GitHub API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privateKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GithubProvider">GithubProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GithubProvider provides access and authentication to a GitHub instance .</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Github instance URL. Defaults to <a href="https://github.com/">https://github.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>uploadURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Upload URL for enterprise instances. Default to URL.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.GithubAppAuth">
- GithubAppAuth
- </a>
- </em>
- </td>
- <td>
- <p>auth configures how secret-manager authenticates with a Github instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretType</code></br>
- <em>
- <a href="#external-secrets.io/v1.GithubSecretType">
- GithubSecretType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>secretType specifies which GitHub secret service to use.
- Defaults to Actions for backwards compatibility.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appID</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <p>appID specifies the Github APP that will be used to authenticate the client</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>installationID</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <p>installationID specifies the Github APP installation that will be used to authenticate the client</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organization</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>organization will be used to fetch secrets from the Github organization</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>repository</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>repository will be used to fetch secrets from the Github repository within an organization</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>environment will be used to fetch secrets from a particular environment within a github repository</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>orgSecretVisibility</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>orgSecretVisibility controls the visibility of organization secrets pushed via PushSecret.
- Valid values are “all” or “private”.
- When unset, new secrets are created with visibility “all” and existing secrets preserve
- whatever visibility they already have in GitHub.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GithubSecretType">GithubSecretType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GithubProvider">GithubProvider</a>)
- </p>
- <p>
- <p>GithubSecretType specifies the GitHub secret service to use.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Actions"</p></td>
- <td><p>GithubSecretTypeActions selects GitHub Actions secrets.</p>
- </td>
- </tr><tr><td><p>"Dependabot"</p></td>
- <td><p>GithubSecretTypeDependabot selects GitHub Dependabot secrets.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.GitlabAuth">GitlabAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GitlabProvider">GitlabProvider</a>)
- </p>
- <p>
- <p>GitlabAuth defines the authentication method for accessing GitLab API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>SecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GitlabSecretRef">
- GitlabSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GitlabProvider">GitlabProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GitlabProvider configures a store to sync secrets with a GitLab instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the GitLab instance URL. Defaults to <a href="https://gitlab.com/">https://gitlab.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.GitlabAuth">
- GitlabAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a GitLab instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID specifies a project where secrets are located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>inheritFromGroups</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>groupIDs</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <p>GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment environment_scope of gitlab CI/CD variables (Please see <a href="https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment">https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment</a> on how to create environments)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Base64 encoded certificate for the GitLab server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
- can be performed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.GitlabSecretRef">GitlabSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GitlabAuth">GitlabAuth</a>)
- </p>
- <p>
- <p>GitlabSecretRef contains the secret reference for GitLab authentication credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AccessToken is used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.IBMAuth">IBMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.IBMProvider">IBMProvider</a>)
- </p>
- <p>
- <p>IBMAuth defines authentication options for connecting to IBM Cloud Secrets Manager.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.IBMAuthSecretRef">
- IBMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>containerAuth</code></br>
- <em>
- <a href="#external-secrets.io/v1.IBMAuthContainerAuth">
- IBMAuthContainerAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.IBMAuthContainerAuth">IBMAuthContainerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.IBMAuth">IBMAuth</a>)
- </p>
- <p>
- <p>IBMAuthContainerAuth defines container-based authentication with IAM Trusted Profile.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>profile</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the IBM Trusted Profile</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenLocation</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Location the token is mounted on the pod</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iamEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.IBMAuthSecretRef">IBMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.IBMAuth">IBMAuth</a>)
- </p>
- <p>
- <p>IBMAuthSecretRef contains the secret reference for IBM Cloud API key authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretApiKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iamEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The IAM endpoint used to obain a token</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.IBMProvider">IBMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>IBMProvider configures a store to sync secrets using a IBM Cloud Secrets Manager
- backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.IBMAuth">
- IBMAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with the IBM secrets manager.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.InfisicalAuth">InfisicalAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalProvider">InfisicalProvider</a>)
- </p>
- <p>
- <p>InfisicalAuth specifies the authentication configuration for Infisical.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>universalAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.UniversalAuthCredentials">
- UniversalAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>azureAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureAuthCredentials">
- AzureAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcpIdTokenAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.GcpIDTokenAuthCredentials">
- GcpIDTokenAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcpIamAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.GcpIamAuthCredentials">
- GcpIamAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwtAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.JwtAuthCredentials">
- JwtAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>ldapAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.LdapAuthCredentials">
- LdapAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>ociAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.OciAuthCredentials">
- OciAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetesAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesAuthCredentials">
- KubernetesAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>awsAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.AwsAuthCredentials">
- AwsAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.TokenAuthCredentials">
- TokenAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.InfisicalProvider">InfisicalProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>InfisicalProvider configures a store to sync secrets using the Infisical provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.InfisicalAuth">
- InfisicalAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Infisical API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretsScope</code></br>
- <em>
- <a href="#external-secrets.io/v1.MachineIdentityScopeInWorkspace">
- MachineIdentityScopeInWorkspace
- </a>
- </em>
- </td>
- <td>
- <p>SecretsScope defines the scope of the secrets within the workspace</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>hostAPI</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to “<a href="https://app.infisical.com/api"">https://app.infisical.com/api”</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a PEM-encoded CA certificate bundle used to validate
- the Infisical server’s TLS certificate. Mutually exclusive with CAProvider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CAProvider is a reference to a Secret or ConfigMap that contains a CA certificate.
- The certificate is used to validate the Infisical server’s TLS certificate.
- Mutually exclusive with CABundle.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.IntegrationInfo">IntegrationInfo
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnePasswordSDKProvider">OnePasswordSDKProvider</a>)
- </p>
- <p>
- <p>IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name defaults to “1Password SDK”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Version defaults to “v1.0.0”.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.JwtAuthCredentials">JwtAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>JwtAuthCredentials represents the credentials for JWT authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.KeeperSecurityProvider">KeeperSecurityProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>KeeperSecurityProvider Configures a store to sync secrets using Keeper Security.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>folderID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>getByTitleFallback</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.KubernetesAuth">KubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CRDProvider">CRDProvider</a>,
- <a href="#external-secrets.io/v1.KubernetesProvider">KubernetesProvider</a>)
- </p>
- <p>
- <p>KubernetesAuth defines authentication options for connecting to a Kubernetes cluster.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>cert</code></br>
- <em>
- <a href="#external-secrets.io/v1.CertAuth">
- CertAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>has both clientCert and clientKey as secretKeySelector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#external-secrets.io/v1.TokenAuth">
- TokenAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>use static token to authenticate with</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccount</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>points to a service account that should be used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.KubernetesAuthCredentials">KubernetesAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>KubernetesAuthCredentials represents the credentials for Kubernetes authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountTokenPath</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.KubernetesProvider">KubernetesProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>KubernetesProvider configures a store to sync secrets with a Kubernetes instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesServer">
- KubernetesServer
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>configures the Kubernetes server Address.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesAuth">
- KubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how secret-manager authenticates with a Kubernetes instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A reference to a secret that contains the auth information.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteNamespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Remote namespace to fetch the secrets from</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.KubernetesServer">KubernetesServer
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.CRDProvider">CRDProvider</a>,
- <a href="#external-secrets.io/v1.KubernetesProvider">KubernetesProvider</a>)
- </p>
- <p>
- <p>KubernetesServer defines configuration for connecting to a Kubernetes API server.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>configures the Kubernetes server Address.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a base64-encoded CA certificate</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.LdapAuthCredentials">LdapAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>LdapAuthCredentials represents the credentials for LDAP authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>ldapPassword</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>ldapUsername</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.MachineIdentityScopeInWorkspace">MachineIdentityScopeInWorkspace
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalProvider">InfisicalProvider</a>)
- </p>
- <p>
- <p>MachineIdentityScopeInWorkspace defines the scope for machine identity within a workspace.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretsPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretsPath specifies the path to the secrets within the workspace. Defaults to “/” if not provided.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>recursive</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>EnvironmentSlug is the required slug identifier for the environment.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectSlug is the required slug identifier for the project.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organizationSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>OrganizationSlug is the optional slug that identifies the organization that will be used
- during authentication. Useful for sub-organization setups</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expandSecretReferences</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>includeSecretPath</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>IncludeSecretPath indicates whether the secret path should be included as a prefix
- in the secret key. Secrets at the root path (/) are not prefixed.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.MaintenanceStatus">MaintenanceStatus
- (<code>string</code> alias)</p></h3>
- <p>
- <p>MaintenanceStatus defines a type for different maintenance states of a provider schema.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Deprecated"</p></td>
- <td></td>
- </tr><tr><td><p>"Maintained"</p></td>
- <td></td>
- </tr><tr><td><p>"NotMaintained"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.ManifestReference">ManifestReference
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ManifestReference defines a custom Kubernetes resource type to be created
- instead of a Secret. This allows ExternalSecret to create ConfigMaps,
- Custom Resources, or any other Kubernetes resource type.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIVersion of the target resource (e.g., “v1” for ConfigMap, “argoproj.io/v1alpha1” for ArgoCD Application)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Kind of the target resource (e.g., “ConfigMap”, “Application”)</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NTLMProtocol">NTLMProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AuthorizationProtocol">AuthorizationProtocol</a>)
- </p>
- <p>
- <p>NTLMProtocol contains the NTLM-specific configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>usernameSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>passwordSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NebiusAuth">NebiusAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NebiusMysteryboxProvider">NebiusMysteryboxProvider</a>)
- </p>
- <p>
- <p>NebiusAuth defines the authentication method for the Nebius provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountCredsSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountCreds references a Kubernetes Secret key that contains a JSON
- document with service account credentials used to get an IAM token.</p>
- <p>Expected JSON structure:
- {
- “subject-credentials”: {
- “alg”: “RS256”,
- “private-key”: “—–BEGIN PRIVATE KEY—–\n<private-key>\n—–END PRIVATE KEY—–\n”,
- “kid”: “<public-key-id>”,
- “iss”: “<issuer-service-account-id>”,
- “sub”: “<subject-service-account-id>”
- }
- }</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Token authenticates with Nebius Mysterybox by presenting a token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#external-secrets.io/v1.NebiusWorkloadIdentity">
- NebiusWorkloadIdentity
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NebiusCAProvider">NebiusCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NebiusMysteryboxProvider">NebiusMysteryboxProvider</a>)
- </p>
- <p>
- <p>NebiusCAProvider The provider for the CA bundle to use to validate Nebius server certificate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NebiusMysteryboxProvider">NebiusMysteryboxProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>NebiusMysteryboxProvider Configures a store to sync secrets using the Nebius Mysterybox provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiDomain</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>NebiusMysterybox API endpoint</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.NebiusAuth">
- NebiusAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines parameters to authenticate in MysteryBox</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.NebiusCAProvider">
- NebiusCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate NebiusMysterybox server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NebiusWorkloadIdentity">NebiusWorkloadIdentity
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NebiusAuth">NebiusAuth</a>)
- </p>
- <p>
- <p>NebiusWorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccountRef references a Kubernetes ServiceAccount used to request a
- temporary JWT via the TokenRequest API. The JWT is then exchanged for a
- Nebius IAM token using workload federation.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iamServiceAccountID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>IAMServiceAccountID is the Nebius IAM service account identifier that the
- federated Kubernetes service account should impersonate during token exchange.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NgrokAuth">NgrokAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NgrokProvider">NgrokProvider</a>)
- </p>
- <p>
- <p>NgrokAuth configures the authentication method for the ngrok provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.NgrokProviderSecretRef">
- NgrokProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>APIKey is the API Key used to authenticate with ngrok. See <a href="https://ngrok.com/docs/api/#authentication">https://ngrok.com/docs/api/#authentication</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NgrokProvider">NgrokProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>NgrokProvider configures a store to sync secrets with a ngrok vault to use in traffic policies.
- See: <a href="https://ngrok.com/blog-post/secrets-for-traffic-policy">https://ngrok.com/blog-post/secrets-for-traffic-policy</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the URL of the ngrok API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.NgrokAuth">
- NgrokAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the ngrok provider authenticates with the ngrok API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- <a href="#external-secrets.io/v1.NgrokVault">
- NgrokVault
- </a>
- </em>
- </td>
- <td>
- <p>Vault configures the ngrok vault to sync secrets with.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NgrokProviderSecretRef">NgrokProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NgrokAuth">NgrokAuth</a>)
- </p>
- <p>
- <p>NgrokProviderSecretRef contains the secret reference for the ngrok provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef is a reference to a secret containing the ngrok API key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NgrokVault">NgrokVault
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.NgrokProvider">NgrokProvider</a>)
- </p>
- <p>
- <p>NgrokVault configures the ngrok vault to sync secrets with.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name is the name of the ngrok vault to sync secrets with.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.NoSecretError">NoSecretError
- </h3>
- <p>
- <p>NoSecretError shall be returned when a GetSecret can not find the
- desired secret. This is used for deletionPolicy.</p>
- </p>
- <h3 id="external-secrets.io/v1.NotModifiedError">NotModifiedError
- </h3>
- <p>
- <p>NotModifiedError to signal that the webhook received no changes,
- and it should just return without doing anything.</p>
- </p>
- <h3 id="external-secrets.io/v1.OciAuthCredentials">OciAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>OciAuthCredentials represents the credentials for OCI authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>privateKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>privateKeyPassphrase</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>fingerprint</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>userId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenancyId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnboardbaseAuthSecretRef">OnboardbaseAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnboardbaseProvider">OnboardbaseProvider</a>)
- </p>
- <p>
- <p>OnboardbaseAuthSecretRef holds secret references for onboardbase API Key credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiKeyRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>OnboardbaseAPIKey is the APIKey generated by an admin account.
- It is used to recognize and authorize access to a project and environment within onboardbase</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>passcodeRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>OnboardbasePasscode is the passcode attached to the API Key</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnboardbaseProvider">OnboardbaseProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OnboardbaseProvider configures a store to sync secrets using the Onboardbase provider.
- Project and Config are required if not using a Service Token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnboardbaseAuthSecretRef">
- OnboardbaseAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Onboardbase API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiHost</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIHost use this to configure the host url for the API for selfhosted installation, default is <a href="https://public.onboardbase.com/api/v1/">https://public.onboardbase.com/api/v1/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Project is an onboardbase project that the secrets should be pulled from</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment is the name of an environmnent within a project to pull the secrets from</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnePasswordAuth">OnePasswordAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnePasswordProvider">OnePasswordProvider</a>)
- </p>
- <p>
- <p>OnePasswordAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnePasswordAuthSecretRef">
- OnePasswordAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnePasswordAuthSecretRef">OnePasswordAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnePasswordAuth">OnePasswordAuth</a>)
- </p>
- <p>
- <p>OnePasswordAuthSecretRef holds secret references for 1Password credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>connectTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The ConnectToken is used for authentication to a 1Password Connect Server.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnePasswordProvider">OnePasswordProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OnePasswordProvider configures a store to sync secrets using the 1Password Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnePasswordAuth">
- OnePasswordAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against OnePassword Connect Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>connectHost</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ConnectHost defines the OnePassword Connect Server to connect to</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaults</code></br>
- <em>
- map[string]int
- </em>
- </td>
- <td>
- <p>Vaults defines which OnePassword vaults to search in which order</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnePasswordSDKAuth">OnePasswordSDKAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OnePasswordSDKProvider">OnePasswordSDKProvider</a>)
- </p>
- <p>
- <p>OnePasswordSDKAuth contains a secretRef for the service account token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OnePasswordSDKProvider">OnePasswordSDKProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OnePasswordSDKProvider configures a store to sync secrets using the 1Password sdk.
- Exactly one of Vault or Environment must be set.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Vault defines the vault’s name or uuid to access. Do NOT add op:// prefix. This will be done automatically.
- Mutually exclusive with Environment.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Environment defines the 1Password Environment ID to read variables from.
- Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set.
- Mutually exclusive with Vault.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>integrationInfo</code></br>
- <em>
- <a href="#external-secrets.io/v1.IntegrationInfo">
- IntegrationInfo
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
- If you don’t know which name and version to use, use <code>DefaultIntegrationName</code> and <code>DefaultIntegrationVersion</code>, respectively.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnePasswordSDKAuth">
- OnePasswordSDKAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against OnePassword API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cache</code></br>
- <em>
- <a href="#external-secrets.io/v1.CacheConfig">
- CacheConfig
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Cache configures client-side caching for read operations (GetSecret, GetSecretMap).
- When enabled, secrets are cached with the specified TTL.
- Write operations (PushSecret, DeleteSecret) automatically invalidate relevant cache entries.
- If omitted, caching is disabled (default).
- cache: {} is a valid option to set.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoAppRole">OpenBaoAppRole
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OpenBaoAuth">OpenBaoAuth</a>)
- </p>
- <p>
- <p>OpenBaoAppRole authenticates with OpenBao using the <a href="https://openbao.org/docs/auth/approle/">App Role auth
- mechanism</a>, with the role and secret stored in a Kubernetes Secret resource.
- The role ID has to be specified either inline via <code>roleId</code> or by referencing
- a secret via <code>roleRef</code>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the App Role authentication backend is mounted
- in OpenBao, e.g: “approle”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RoleID configured in the App Role authentication backend when setting
- up the authentication backend in OpenBao.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reference to a key in a Secret that contains the App Role ID used
- to authenticate with OpenBao.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role id.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Reference to a key in a Secret that contains the App Role secret used
- to authenticate with OpenBao.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoAuth">OpenBaoAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OpenBaoProvider">OpenBaoProvider</a>)
- </p>
- <p>
- <p>OpenBaoAuth is the configuration used to authenticate with an OpenBao server.
- Currently the following authentication methods are supported: <a href="https://openbao.org/docs/auth/approle/">AppRole</a>,
- <a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes</a>, <a href="https://openbao.org/docs/auth/token/">Token</a> and <a href="https://openbao.org/docs/auth/userpass/">UserPass</a></p>
- <p>Additional authentication methods are planned for future releases.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>appRole</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoAppRole">
- OpenBaoAppRole
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AppRole authenticates with OpenBao using the <a href="https://openbao.org/docs/auth/approle/">App Role auth mechanism</a>,
- with the role and secret stored in a Kubernetes Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetes</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoKubernetesAuth">
- OpenBaoKubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes authenticates with OpenBao by passing a ServiceAccount
- token to the <a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes auth mechanism</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the <a href="https://openbao.org/docs/concepts/namespaces/">OpenBao Namespace</a> to authenticate to. This can be different
- than the namespace your secret is in. Namespaces is a set of features
- within OpenBao that allows OpenBao environments to support secure
- multi-tenancy. e.g: “ns1”. This will default to OpenBao.Namespace field
- if set, or empty otherwise</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TokenSecretRef authenticates with OpenBao by presenting a token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>userPass</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoUserPassAuth">
- OpenBaoUserPassAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UserPass authenticates with OpenBao by passing a username/password pair</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoKVStoreVersion">OpenBaoKVStoreVersion
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OpenBaoProvider">OpenBaoProvider</a>)
- </p>
- <p>
- <p>OpenBaoKVStoreVersion represents the version of the OpenBao KV secret engine.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"v1"</p></td>
- <td></td>
- </tr><tr><td><p>"v2"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoKubernetesAuth">OpenBaoKubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OpenBaoAuth">OpenBaoAuth</a>)
- </p>
- <p>
- <p>OpenBaoKubernetesAuth authenticates with OpenBao using the <a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes
- auth mechanism</a> with a ServiceAccount token. The ServiceAccount token can be
- sourced from a ServiceAccount via <code>ServiceAccountRef</code> or from a secret
- via <code>SecretRef</code>.
- Using the controller pod’s ServiceAccount token is not supported.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
- “kubernetes”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional service account field containing the name of a Kubernetes ServiceAccount.
- If the service account is specified, a token will be requested from the Kubernetes
- TokenRequest API for authenticating with OpenBao.
- Any configured audiences will be passed to the TokenRequest as-is.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with OpenBao. If a name is specified without a key,
- <code>token</code> is the default.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A required field containing the OpenBao Role to assume. A Role binds a
- Kubernetes ServiceAccount with a set of OpenBao policies.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoProvider">OpenBaoProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OpenBaoProvider configures a store to sync secrets using an OpenBao KV backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoAuth">
- OpenBaoAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how secret-manager authenticates with the OpenBao server.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate the OpenBao server certificate. If
- this and <code>caProvider</code> are not set the system root certificates are used
- to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate OpenBao server
- certificate. If this and <code>caBundle</code> are not set the system root
- certificates are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the <a href="https://openbao.org/docs/concepts/namespaces/">OpenBao Namespace</a>. Namespaces is a set of features within
- OpenBao that allows OpenBao environments to support secure multi-tenancy.
- e.g: “ns1”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Server is the connection address for the OpenBao server, e.g: <code>https://openbao.example.com:8200</code>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path is the mount path of the OpenBao KV backend endpoint, e.g:
- “secret”. The v2 KV secret engine version specific “/data” path suffix
- for fetching secrets from OpenBao is optional and will be appended
- if not present in specified path.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoKVStoreVersion">
- OpenBaoKVStoreVersion
- </a>
- </em>
- </td>
- <td>
- <p>Version is the OpenBao KV secret engine version. This can be either “v1” or
- “v2”. Version defaults to “v2”.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OpenBaoUserPassAuth">OpenBaoUserPassAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OpenBaoAuth">OpenBaoAuth</a>)
- </p>
- <p>
- <p>OpenBaoUserPassAuth authenticates with OpenBao using <a href="https://openbao.org/docs/auth/userpass/">UserPass authentication
- method</a>, with the username and password stored in a Kubernetes Secret
- resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the UserPassword authentication backend is mounted
- in OpenBao, e.g: “userpass”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Username is a username used to authenticate using the <a href="https://openbao.org/docs/auth/userpass/">UserPass
- authentication method</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef to a key in a Secret resource containing password for the user
- used to authenticate with OpenBao using the <a href="https://openbao.org/docs/auth/userpass/">UserPass authentication
- method</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OracleAuth">OracleAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OracleProvider">OracleProvider</a>)
- </p>
- <p>
- <p>OracleAuth defines the authentication method for the Oracle Vault provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>tenancy</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Tenancy is the tenancy OCID where user is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>user</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>User is an access OCID specific to the account.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.OracleSecretRef">
- OracleSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef to pass through sensitive information.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OraclePrincipalType">OraclePrincipalType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OracleProvider">OracleProvider</a>)
- </p>
- <p>
- <p>OraclePrincipalType defines the type of principal used for authentication with Oracle Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"InstancePrincipal"</p></td>
- <td><p>InstancePrincipal represents a instance principal.</p>
- </td>
- </tr><tr><td><p>"UserPrincipal"</p></td>
- <td><p>UserPrincipal represents a user principal.</p>
- </td>
- </tr><tr><td><p>"Workload"</p></td>
- <td><p>WorkloadPrincipal represents a workload principal.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.OracleProvider">OracleProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OracleProvider configures a store to sync secrets using an Oracle Vault
- backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region is the region where vault is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault is the vault’s OCID of the specific vault where secret is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>compartment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Compartment is the vault compartment OCID.
- Required for PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>encryptionKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>EncryptionKey is the OCID of the encryption key within the vault.
- Required for PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>principalType</code></br>
- <em>
- <a href="#external-secrets.io/v1.OraclePrincipalType">
- OraclePrincipalType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The type of principal to use for authentication. If left blank, the Auth struct will
- determine the principal type. This optional field must be specified if using
- workload identity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OracleAuth">
- OracleAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how secret-manager authenticates with the Oracle Vault.
- If empty, use the instance principal, otherwise the user credentials specified in Auth.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specified the service account
- that should be used when authenticating with WorkloadIdentity.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OracleSecretRef">OracleSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OracleAuth">OracleAuth</a>)
- </p>
- <p>
- <p>OracleSecretRef contains the secret reference for Oracle Vault authentication credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privatekey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>PrivateKey is the user’s API Signing Key in PEM format, used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fingerprint</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Fingerprint is the fingerprint of the API private key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OvhAuth">OvhAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OvhProvider">OvhProvider</a>)
- </p>
- <p>
- <p>OvhAuth tells the controller how to authenticate to OVHcloud’s Secret Manager, either using mTLS or a token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>mtls</code></br>
- <em>
- <a href="#external-secrets.io/v1.OvhClientMTLS">
- OvhClientMTLS
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#external-secrets.io/v1.OvhClientToken">
- OvhClientToken
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OvhClientMTLS">OvhClientMTLS
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OvhAuth">OvhAuth</a>)
- </p>
- <p>
- <p>OvhClientMTLS defines the configuration required to authenticate to OVHcloud’s Secret Manager using mTLS.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>keySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OvhClientToken">OvhClientToken
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.OvhAuth">OvhAuth</a>)
- </p>
- <p>
- <p>OvhClientToken defines the configuration required to authenticate to OVHcloud’s Secret Manager using a token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>tokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.OvhProvider">OvhProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OvhProvider holds the configuration to synchronize secrets with OVHcloud’s Secret Manager.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>specifies the OKMS server endpoint.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>okmsid</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>specifies the OKMS ID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>casRequired</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Enables or disables check-and-set (CAS) (default: false).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>okmsTimeout</code></br>
- <em>
- uint32
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Setup a timeout in seconds when requests to the KMS are made (default: 30).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.OvhAuth">
- OvhAuth
- </a>
- </em>
- </td>
- <td>
- <p>Authentication method (mtls or token).</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PassboltAuth">PassboltAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PassboltProvider">PassboltProvider</a>)
- </p>
- <p>
- <p>PassboltAuth contains a secretRef for the passbolt credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>passwordSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>privateKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PassboltProvider">PassboltProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PassboltProvider provides access to Passbolt secrets manager.
- See: <a href="https://www.passbolt.com">https://www.passbolt.com</a>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.PassboltAuth">
- PassboltAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Passbolt Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>host</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Host defines the Passbolt Server to connect to</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate Passbolt server certificate. Only used
- if the Host URL is using HTTPS protocol. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Passbolt server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PasswordDepotAuth">PasswordDepotAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PasswordDepotProvider">PasswordDepotProvider</a>)
- </p>
- <p>
- <p>PasswordDepotAuth defines the authentication method for the Password Depot provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.PasswordDepotSecretRef">
- PasswordDepotSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PasswordDepotProvider">PasswordDepotProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PasswordDepotProvider configures a store to sync secrets with a Password Depot instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>host</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Password Depot instance URL.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>database</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Database to use as source</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.PasswordDepotAuth">
- PasswordDepotAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a Password Depot instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PasswordDepotSecretRef">PasswordDepotSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PasswordDepotAuth">PasswordDepotAuth</a>)
- </p>
- <p>
- <p>PasswordDepotSecretRef contains the secret reference for Password Depot authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credentials</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username / Password is used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PreviderAuth">PreviderAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PreviderProvider">PreviderProvider</a>)
- </p>
- <p>
- <p>PreviderAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.PreviderAuthSecretRef">
- PreviderAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PreviderAuthSecretRef">PreviderAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PreviderAuth">PreviderAuth</a>)
- </p>
- <p>
- <p>PreviderAuthSecretRef holds secret references for Previder Vault credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessToken is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PreviderProvider">PreviderProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PreviderProvider configures a store to sync secrets using the Previder Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.PreviderAuth">
- PreviderAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>baseUri</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.Provider">Provider
- </h3>
- <p>
- <p>Provider is a common interface for interacting with secret backends.</p>
- </p>
- <h3 id="external-secrets.io/v1.PulumiAuth">PulumiAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PulumiProvider">PulumiProvider</a>)
- </p>
- <p>
- <p>PulumiAuth configures authentication with the Pulumi API.
- Exactly one of accessToken or oidcConfig must be specified.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="#external-secrets.io/v1.PulumiProviderSecretRef">
- PulumiProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AccessToken authenticates using a Pulumi access token stored in a Kubernetes Secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>oidcConfig</code></br>
- <em>
- <a href="#external-secrets.io/v1.PulumiOIDCAuth">
- PulumiOIDCAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PulumiOIDCAuth">PulumiOIDCAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PulumiAuth">PulumiAuth</a>)
- </p>
- <p>
- <p>PulumiOIDCAuth configures OIDC authentication with Pulumi using Kubernetes ServiceAccount tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>organization</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Organization is the name of the Pulumi organization configured for OIDC authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expirationSeconds</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpirationSeconds sets the token validity duration for service account and OIDC token.
- Defaults to 10 minutes.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PulumiProvider">PulumiProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PulumiProvider defines configuration for accessing secrets from Pulumi ESC.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the URL of the Pulumi API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.PulumiAuth">
- PulumiAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how the Operator authenticates with the Pulumi API.
- Either auth or the deprecated accessToken field must be specified.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organization</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Organization are a space to collaborate on shared projects and stacks.
- To create a new organization, visit <a href="https://app.pulumi.com/">https://app.pulumi.com/</a> and click “New Organization”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Project is the name of the Pulumi ESC project the environment belongs to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment are YAML documents composed of static key-value pairs, programmatic expressions,
- dynamically retrieved values from supported providers including all major clouds,
- and other Pulumi ESC environments.
- To create a new environment, visit <a href="https://www.pulumi.com/docs/esc/environments/">https://www.pulumi.com/docs/esc/environments/</a> for more information.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="#external-secrets.io/v1.PulumiProviderSecretRef">
- PulumiProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AccessToken is the access tokens to sign in to the Pulumi Cloud Console.</p>
- <p>Deprecated: Use auth.accessToken instead.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PulumiProviderSecretRef">PulumiProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.PulumiAuth">PulumiAuth</a>,
- <a href="#external-secrets.io/v1.PulumiProvider">PulumiProvider</a>)
- </p>
- <p>
- <p>PulumiProviderSecretRef contains the secret reference for Pulumi authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef is a reference to a secret containing the Pulumi API token.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.PushSecretData">PushSecretData
- </h3>
- <p>
- <p>PushSecretData is an interface to allow using v1alpha1.PushSecretData content in Provider registered in v1.</p>
- </p>
- <h3 id="external-secrets.io/v1.PushSecretRemoteRef">PushSecretRemoteRef
- </h3>
- <p>
- <p>PushSecretRemoteRef is an interface to allow using v1alpha1.PushSecretRemoteRef in Provider registered in v1.</p>
- </p>
- <h3 id="external-secrets.io/v1.ScalewayProvider">ScalewayProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ScalewayProvider defines the configuration for the Scaleway Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>APIURL is the url of the api to use. Defaults to <a href="https://api.scaleway.com">https://api.scaleway.com</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region where your secrets are located: <a href="https://developers.scaleway.com/en/quickstart/#region-and-zone">https://developers.scaleway.com/en/quickstart/#region-and-zone</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID is the id of your project, which you can find in the console: <a href="https://console.scaleway.com/project/settings">https://console.scaleway.com/project/settings</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.ScalewayProviderSecretRef">
- ScalewayProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>AccessKey is the non-secret part of the api key.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretKey</code></br>
- <em>
- <a href="#external-secrets.io/v1.ScalewayProviderSecretRef">
- ScalewayProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>SecretKey is the non-secret part of the api key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ScalewayProviderSecretRef">ScalewayProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ScalewayProvider">ScalewayProvider</a>)
- </p>
- <p>
- <p>ScalewayProviderSecretRef defines the configuration for Scaleway secret references.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretReference">SecretReference
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AwsCredentialsConfig">AwsCredentialsConfig</a>)
- </p>
- <p>
- <p>SecretReference holds the details of a secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>name of the secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>namespace in which the secret exists. If empty, secret will looked up in local namespace.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretServerProvider">SecretServerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>SecretServerProvider provides access to authenticate to a secrets provider server.
- See: <a href="https://github.com/DelineaXPM/tss-sdk-go/blob/main/server/server.go">https://github.com/DelineaXPM/tss-sdk-go/blob/main/server/server.go</a>.
- Authentication requires either Token, or both Username and Password. If Token is
- set it takes precedence and Username/Password are ignored.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretServerProviderRef">
- SecretServerProviderRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username is the secret server account username.
- Required unless Token is set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>password</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretServerProviderRef">
- SecretServerProviderRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Password is the secret server account password.
- Required unless Token is set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretServerProviderRef">
- SecretServerProviderRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Token is an access token used to authenticate to the secret server,
- as an alternative to Username and Password. When set, Username and
- Password are not required and are ignored.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>domain</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Domain is the secret server domain.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serverURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServerURL
- URL to your secret server installation</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>siteId</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SiteID is the ID of the Secret Server site for new secrets.
- PushSecret metadata can override this value for one secret.
- The provider uses 1 if this field is not set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>disableSiteIDValidation</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DisableSiteIDValidation permits a missing site ID for new secrets.
- The provider sends 0 if no site ID is set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM/base64 encoded CA bundle used to validate Secret ServerURL. Only used
- if the ServerURL URL is using HTTPS protocol. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Secret ServerURL certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretServerProviderRef">SecretServerProviderRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretServerProvider">SecretServerProvider</a>)
- </p>
- <p>
- <p>SecretServerProviderRef references a value that can be specified directly or via a secret
- for a SecretServerProvider. Exactly one of Value or SecretRef must be set.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStore">SecretStore
- </h3>
- <p>
- <p>SecretStore represents a secure external location for storing secrets, which can be referenced as part of <code>storeRef</code> fields.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreSpec">
- SecretStoreSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- k8s.io/apimachinery/pkg/util/intstr.IntOrString
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval. Accepts either an integer number
- of seconds (legacy) or a Go duration string such as “1h” or “5m”. Empty or
- 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreStatus">
- SecretStoreStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreCapabilities">SecretStoreCapabilities
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreStatus">SecretStoreStatus</a>)
- </p>
- <p>
- <p>SecretStoreCapabilities defines the possible operations a SecretStore can do.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ReadOnly"</p></td>
- <td><p>SecretStoreReadOnly indicates that the store can only read secrets.</p>
- </td>
- </tr><tr><td><p>"ReadWrite"</p></td>
- <td><p>SecretStoreReadWrite indicates that the store can both read and write secrets.</p>
- </td>
- </tr><tr><td><p>"WriteOnly"</p></td>
- <td><p>SecretStoreWriteOnly indicates that the store can only write secrets.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreConditionType">SecretStoreConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreStatusCondition">SecretStoreStatusCondition</a>)
- </p>
- <p>
- <p>SecretStoreConditionType represents the condition of the SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>SecretStoreReady indicates that the store is ready and able to serve requests.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreSpec">SecretStoreSpec</a>)
- </p>
- <p>
- <p>SecretStoreProvider contains the provider-specific configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>aws</code></br>
- <em>
- <a href="#external-secrets.io/v1.AWSProvider">
- AWSProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS configures this store to sync secrets using AWS Secret Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>azurekv</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureKVProvider">
- AzureKVProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AzureKV configures this store to sync secrets using Azure Key Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>akeyless</code></br>
- <em>
- <a href="#external-secrets.io/v1.AkeylessProvider">
- AkeylessProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Akeyless configures this store to sync secrets using Akeyless Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>bitwardensecretsmanager</code></br>
- <em>
- <a href="#external-secrets.io/v1.BitwardenSecretsManagerProvider">
- BitwardenSecretsManagerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultProvider">
- VaultProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Vault configures this store to sync secrets using the HashiCorp Vault provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ovh</code></br>
- <em>
- <a href="#external-secrets.io/v1.OvhProvider">
- OvhProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OVHcloud configures this store to sync secrets using the OVHcloud provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcpsm</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPSMProvider">
- GCPSMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>oracle</code></br>
- <em>
- <a href="#external-secrets.io/v1.OracleProvider">
- OracleProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Oracle configures this store to sync secrets using Oracle Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ibm</code></br>
- <em>
- <a href="#external-secrets.io/v1.IBMProvider">
- IBMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>IBM configures this store to sync secrets using IBM Cloud provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>yandexcertificatemanager</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexCertificateManagerProvider">
- YandexCertificateManagerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>yandexlockbox</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexLockboxProvider">
- YandexLockboxProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>YandexLockbox configures this store to sync secrets using Yandex Lockbox provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>github</code></br>
- <em>
- <a href="#external-secrets.io/v1.GithubProvider">
- GithubProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
- Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gitlab</code></br>
- <em>
- <a href="#external-secrets.io/v1.GitlabProvider">
- GitlabProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GitLab configures this store to sync secrets using GitLab Variables provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>onepassword</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnePasswordProvider">
- OnePasswordProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OnePassword configures this store to sync secrets using the 1Password Cloud provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>onepasswordSDK</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnePasswordSDKProvider">
- OnePasswordSDKProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OnePasswordSDK configures this store to use 1Password’s new Go SDK to sync secrets.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>webhook</code></br>
- <em>
- <a href="#external-secrets.io/v1.WebhookProvider">
- WebhookProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Webhook configures this store to sync secrets using a generic templated webhook</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetes</code></br>
- <em>
- <a href="#external-secrets.io/v1.KubernetesProvider">
- KubernetesProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes configures this store to sync secrets using a Kubernetes cluster provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>crd</code></br>
- <em>
- <a href="#external-secrets.io/v1.CRDProvider">
- CRDProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CRD configures this store to sync secrets from arbitrary Kubernetes resources,
- including both custom resources (CRDs) and core API resources. Resources are
- selected by API group, version and kind, where group can be “” (empty string)
- for core resources such as ConfigMap. Reading the core v1 Secret is
- intentionally blocked — use the Kubernetes provider for that.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fake</code></br>
- <em>
- <a href="#external-secrets.io/v1.FakeProvider">
- FakeProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Fake configures a store with static key/value pairs</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>senhasegura</code></br>
- <em>
- <a href="#external-secrets.io/v1.SenhaseguraProvider">
- SenhaseguraProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Senhasegura configures this store to sync secrets using senhasegura provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scaleway</code></br>
- <em>
- <a href="#external-secrets.io/v1.ScalewayProvider">
- ScalewayProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Scaleway configures this store to sync secrets using the Scaleway provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>doppler</code></br>
- <em>
- <a href="#external-secrets.io/v1.DopplerProvider">
- DopplerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler configures this store to sync secrets using the Doppler provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>previder</code></br>
- <em>
- <a href="#external-secrets.io/v1.PreviderProvider">
- PreviderProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Previder configures this store to sync secrets using the Previder provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>onboardbase</code></br>
- <em>
- <a href="#external-secrets.io/v1.OnboardbaseProvider">
- OnboardbaseProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Onboardbase configures this store to sync secrets using the Onboardbase provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keepersecurity</code></br>
- <em>
- <a href="#external-secrets.io/v1.KeeperSecurityProvider">
- KeeperSecurityProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conjur</code></br>
- <em>
- <a href="#external-secrets.io/v1.ConjurProvider">
- ConjurProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Conjur configures this store to sync secrets using conjur provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>delinea</code></br>
- <em>
- <a href="#external-secrets.io/v1.DelineaProvider">
- DelineaProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Delinea DevOps Secrets Vault
- <a href="https://docs.delinea.com/online-help/products/devops-secrets-vault/current">https://docs.delinea.com/online-help/products/devops-secrets-vault/current</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretserver</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretServerProvider">
- SecretServerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretServer configures this store to sync secrets using SecretServer provider
- <a href="https://docs.delinea.com/online-help/secret-server/start.htm">https://docs.delinea.com/online-help/secret-server/start.htm</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>chef</code></br>
- <em>
- <a href="#external-secrets.io/v1.ChefProvider">
- ChefProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Chef configures this store to sync secrets with chef server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pulumi</code></br>
- <em>
- <a href="#external-secrets.io/v1.PulumiProvider">
- PulumiProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Pulumi configures this store to sync secrets using the Pulumi provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fortanix</code></br>
- <em>
- <a href="#external-secrets.io/v1.FortanixProvider">
- FortanixProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Fortanix configures this store to sync secrets using the Fortanix provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>passworddepot</code></br>
- <em>
- <a href="#external-secrets.io/v1.PasswordDepotProvider">
- PasswordDepotProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>passbolt</code></br>
- <em>
- <a href="#external-secrets.io/v1.PassboltProvider">
- PassboltProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>dvls</code></br>
- <em>
- <a href="#external-secrets.io/v1.DVLSProvider">
- DVLSProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DVLS configures this store to sync secrets using Devolutions Server provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>infisical</code></br>
- <em>
- <a href="#external-secrets.io/v1.InfisicalProvider">
- InfisicalProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Infisical configures this store to sync secrets using the Infisical provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>beyondtrust</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustProvider">
- BeyondtrustProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Beyondtrust configures this store to sync secrets using Password Safe provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>beyondtrustworkloadcredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">
- BeyondtrustWorkloadCredentialsProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>BeyondtrustWorkloadCredentials configures this store to sync secrets using the BeyondTrust Workload Credentials provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cloudrusm</code></br>
- <em>
- <a href="#external-secrets.io/v1.CloudruSMProvider">
- CloudruSMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>volcengine</code></br>
- <em>
- <a href="#external-secrets.io/v1.VolcengineProvider">
- VolcengineProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Volcengine configures this store to sync secrets using the Volcengine provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ngrok</code></br>
- <em>
- <a href="#external-secrets.io/v1.NgrokProvider">
- NgrokProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Ngrok configures this store to sync secrets using the ngrok provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>barbican</code></br>
- <em>
- <a href="#external-secrets.io/v1.BarbicanProvider">
- BarbicanProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Barbican configures this store to sync secrets using the OpenStack Barbican provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>nebiusmysterybox</code></br>
- <em>
- <a href="#external-secrets.io/v1.NebiusMysteryboxProvider">
- NebiusMysteryboxProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>NebiusMysterybox configures this store to sync secrets using NebiusMysterybox provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>openBao</code></br>
- <em>
- <a href="#external-secrets.io/v1.OpenBaoProvider">
- OpenBaoProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OpenBao configures this store to sync secrets using the OpenBao provider.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreRef">SecretStoreRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretSpec">ExternalSecretSpec</a>,
- <a href="#external-secrets.io/v1.StoreGeneratorSourceRef">StoreGeneratorSourceRef</a>,
- <a href="#external-secrets.io/v1.StoreSourceRef">StoreSourceRef</a>)
- </p>
- <p>
- <p>SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the SecretStore resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
- Defaults to <code>SecretStore</code></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreRetrySettings">SecretStoreRetrySettings
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreSpec">SecretStoreSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecretSpec">BeyondtrustWorkloadCredentialsDynamicSecretSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">VaultDynamicSecretSpec</a>)
- </p>
- <p>
- <p>SecretStoreRetrySettings defines the retry settings for accessing external secrets manager stores.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>maxRetries</code></br>
- <em>
- int32
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>retryInterval</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreSpec">SecretStoreSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterSecretStore">ClusterSecretStore</a>,
- <a href="#external-secrets.io/v1.SecretStore">SecretStore</a>)
- </p>
- <p>
- <p>SecretStoreSpec defines the desired state of SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- k8s.io/apimachinery/pkg/util/intstr.IntOrString
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval. Accepts either an integer number
- of seconds (legacy) or a Go duration string such as “1h” or “5m”. Empty or
- 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreStatus">SecretStoreStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ClusterSecretStore">ClusterSecretStore</a>,
- <a href="#external-secrets.io/v1.SecretStore">SecretStore</a>)
- </p>
- <p>
- <p>SecretStoreStatus defines the observed state of the SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreStatusCondition">
- []SecretStoreStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>capabilities</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreCapabilities">
- SecretStoreCapabilities
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretStoreStatusCondition">SecretStoreStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreStatus">SecretStoreStatus</a>)
- </p>
- <p>
- <p>SecretStoreStatusCondition contains condition information for a SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreConditionType">
- SecretStoreConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretVersionSelectionPolicy">SecretVersionSelectionPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.GCPSMProvider">GCPSMProvider</a>)
- </p>
- <p>
- <p>SecretVersionSelectionPolicy defines the policy for selecting secret versions in GCP Secret Manager.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"LatestOrFail"</p></td>
- <td><p>SecretVersionSelectionPolicyLatestOrFail means the provider always uses “latest”, or fails if that version is disabled/destroyed.</p>
- </td>
- </tr><tr><td><p>"LatestOrFetch"</p></td>
- <td><p>SecretVersionSelectionPolicyLatestOrFetch behaves like SecretVersionSelectionPolicyLatestOrFail but falls back to fetching the latest version if the version is DESTROYED or DISABLED.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.SecretsClient">SecretsClient
- </h3>
- <p>
- <p>SecretsClient provides access to secrets.</p>
- </p>
- <h3 id="external-secrets.io/v1.SecretsManager">SecretsManager
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>SecretsManager defines how the provider behaves when interacting with AWS
- SecretsManager. Some of these settings are only applicable to controlling how
- secrets are deleted, and hence only apply to PushSecret (and only when
- deletionPolicy is set to Delete).</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>forceDeleteWithoutRecovery</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specifies whether to delete the secret without any recovery window. You
- can’t use both this parameter and RecoveryWindowInDays in the same call.
- If you don’t use either, then by default Secrets Manager uses a 30 day
- recovery window.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery">https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>recoveryWindowInDays</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The number of days from 7 to 30 that Secrets Manager waits before
- permanently deleting the secret. You can’t use both this parameter and
- ForceDeleteWithoutRecovery in the same call. If you don’t use either,
- then by default Secrets Manager uses a 30-day recovery window.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays">https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SenhaseguraAuth">SenhaseguraAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SenhaseguraProvider">SenhaseguraProvider</a>)
- </p>
- <p>
- <p>SenhaseguraAuth tells the controller how to do auth in senhasegura.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecretSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SenhaseguraModuleType">SenhaseguraModuleType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SenhaseguraProvider">SenhaseguraProvider</a>)
- </p>
- <p>
- <p>SenhaseguraModuleType enum defines senhasegura target module to fetch secrets</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"DSM"</p></td>
- <td><pre><code> SenhaseguraModuleDSM is the senhasegura DevOps Secrets Management module
- see: https://senhasegura.com/devops
- </code></pre>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.SenhaseguraProvider">SenhaseguraProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>SenhaseguraProvider setup a store to sync secrets with senhasegura.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL of senhasegura</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>module</code></br>
- <em>
- <a href="#external-secrets.io/v1.SenhaseguraModuleType">
- SenhaseguraModuleType
- </a>
- </em>
- </td>
- <td>
- <p>Module defines which senhasegura module should be used to get secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.SenhaseguraAuth">
- SenhaseguraAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines parameters to authenticate in senhasegura</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ignoreSslCertificate</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>IgnoreSslCertificate defines if SSL certificate must be ignored</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.SessionTagsPolicy">SessionTagsPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>SessionTagsPolicy defines how STS session tags are handled.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Custom"</p></td>
- <td><p>SessionTagsPolicyCustom adds the tags defined in CustomSessionTags in addition to
- the esoNamespace, esoStoreName, and esoStoreKind tags.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>SessionTagsPolicyNone is the default behavior - no session tags are added.</p>
- </td>
- </tr><tr><td><p>"Simple"</p></td>
- <td><p>SessionTagsPolicySimple automatically adds esoNamespace, esoStoreName, and esoStoreKind
- session tags.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.StoreGeneratorSourceRef">StoreGeneratorSourceRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>StoreGeneratorSourceRef allows you to override the source
- from which the secret will be pulled from.
- You can define at maximum one property.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>storeRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>generatorRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GeneratorRef">
- GeneratorRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GeneratorRef points to a generator custom resource.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.StoreSourceRef">StoreSourceRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretData">ExternalSecretData</a>)
- </p>
- <p>
- <p>StoreSourceRef allows you to override the SecretStore source
- from which the secret will be pulled from.
- You can define at maximum one property.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>storeRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>generatorRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GeneratorRef">
- GeneratorRef
- </a>
- </em>
- </td>
- <td>
- <p>GeneratorRef points to a generator custom resource.</p>
- <p>Deprecated: The generatorRef is not implemented in .data[].
- this will be removed with v1.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.Tag">Tag
- </h3>
- <p>
- <p>Tag is a key-value pair that can be attached to an AWS resource.
- see: <a href="https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html">https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateEngineVersion">TemplateEngineVersion
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateEngineVersion specifies the template engine version that should be used to
- compile/execute the template.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"v2"</p></td>
- <td><p>TemplateEngineV2 is the currently supported template engine version.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateFrom">TemplateFrom
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateFrom specifies a source for templates.
- Each item in the list can either reference a ConfigMap or a Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>configMap</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateRef">
- TemplateRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>secret</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateRef">
- TemplateRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Target specifies where to place the template result.
- For Secret resources the accepted values are empty, “Data”, “Annotations” and “Labels”;
- any other value is rejected because it would allow writes to privileged Secret fields.
- For custom resources (when spec.target.manifest is set), this supports
- nested paths like “spec.database.config” or “data”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>literal</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>valuesDecodingStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretDecodingStrategy">
- ExternalSecretDecodingStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a decoding Strategy for the rendered template values.
- Defaults to None when omitted.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateMergePolicy">TemplateMergePolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Merge"</p></td>
- <td></td>
- </tr><tr><td><p>"Replace"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateRef">TemplateRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.TemplateFrom">TemplateFrom</a>)
- </p>
- <p>
- <p>TemplateRef specifies a reference to either a ConfigMap or a Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the ConfigMap/Secret resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>items</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateRefItem">
- []TemplateRefItem
- </a>
- </em>
- </td>
- <td>
- <p>A list of keys in the ConfigMap/Secret to use as templates for Secret data</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateRefItem">TemplateRefItem
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.TemplateRef">TemplateRef</a>)
- </p>
- <p>
- <p>TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A key in the ConfigMap/Secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>templateAs</code></br>
- <em>
- <a href="#external-secrets.io/v1.TemplateScope">
- TemplateScope
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.TemplateScope">TemplateScope
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.TemplateRefItem">TemplateRefItem</a>)
- </p>
- <p>
- <p>TemplateScope specifies how the template keys should be interpreted.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"KeysAndValues"</p></td>
- <td></td>
- </tr><tr><td><p>"Values"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.TokenAuth">TokenAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.KubernetesAuth">KubernetesAuth</a>)
- </p>
- <p>
- <p>TokenAuth defines token-based authentication configuration for Kubernetes.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>bearerToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.TokenAuthCredentials">TokenAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>TokenAuthCredentials represents the credentials for access token-based authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.UniversalAuthCredentials">UniversalAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>UniversalAuthCredentials represents the client credentials for universal authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.ValidationResult">ValidationResult
- (<code>byte</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.FakeProvider">FakeProvider</a>)
- </p>
- <p>
- <p>ValidationResult is defined type for the number of validation results.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>2</p></td>
- <td><p>ValidationResultError indicates that there is a misconfiguration.</p>
- </td>
- </tr><tr><td><p>0</p></td>
- <td><p>ValidationResultReady indicates that the client is configured correctly
- and can be used.</p>
- </td>
- </tr><tr><td><p>1</p></td>
- <td><p>ValidationResultUnknown indicates that the client can be used
- but information is missing, and it can not be validated.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultAppRole">VaultAppRole
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultAppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the App Role authentication backend is mounted
- in Vault, e.g: “approle”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RoleID configured in the App Role authentication backend when setting
- up the authentication backend in Vault.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reference to a key in a Secret that contains the App Role ID used
- to authenticate with Vault.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role id.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Reference to a key in a Secret that contains the App Role secret used
- to authenticate with Vault.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultAuth">VaultAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultAuth is the configuration used to authenticate with a Vault server.
- Only one of <code>tokenSecretRef</code>, <code>appRole</code>, <code>kubernetes</code>, <code>ldap</code>, <code>userPass</code>, <code>jwt</code>, <code>cert</code>, <code>iam</code> or <code>gcp</code>
- can be specified. A namespace to authenticate against can optionally be specified.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
- Namespaces is a set of features within Vault Enterprise that allows
- Vault environments to support Secure Multi-tenancy. e.g: “ns1”.
- More about namespaces can be found here <a href="https://www.vaultproject.io/docs/enterprise/namespaces">https://www.vaultproject.io/docs/enterprise/namespaces</a>
- This will default to Vault.Namespace field if set, or empty otherwise</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TokenSecretRef authenticates with Vault by presenting a token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appRole</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAppRole">
- VaultAppRole
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetes</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultKubernetesAuth">
- VaultKubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes authenticates with Vault by passing the ServiceAccount
- token stored in the named Secret resource to the Vault server.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ldap</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultLdapAuth">
- VaultLdapAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Ldap authenticates with Vault by passing username/password pair using
- the LDAP authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultJwtAuth">
- VaultJwtAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Jwt authenticates with Vault by passing role and JWT token using the
- JWT/OIDC authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cert</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultCertAuth">
- VaultCertAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
- Cert authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iam</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultIamAuth">
- VaultIamAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
- AWS IAM authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>userPass</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultUserPassAuth">
- VaultUserPassAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UserPass authenticates with Vault by passing username/password pair</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcp</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultGCPAuth">
- VaultGCPAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Gcp authenticates with Vault using Google Cloud Platform authentication method
- GCP authentication method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultAwsAuth">VaultAwsAuth
- </h3>
- <p>
- <p>VaultAwsAuth tells the controller how to do authentication with aws.
- Only one of secretRef or jwt can be specified.
- if none is specified the controller will try to load credentials from its own service account assuming it is IRSA enabled.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAwsAuthSecretRef">
- VaultAwsAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAwsJWTAuth">
- VaultAwsJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultAwsAuthSecretRef">VaultAwsAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAwsAuth">VaultAwsAuth</a>,
- <a href="#external-secrets.io/v1.VaultIamAuth">VaultIamAuth</a>)
- </p>
- <p>
- <p>VaultAwsAuthSecretRef holds secret references for AWS credentials
- both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SessionToken used for authentication
- This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
- see: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultAwsJWTAuth">VaultAwsJWTAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAwsAuth">VaultAwsAuth</a>,
- <a href="#external-secrets.io/v1.VaultIamAuth">VaultIamAuth</a>)
- </p>
- <p>
- <p>VaultAwsJWTAuth Authenticate against AWS using service account tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultCertAuth">VaultCertAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultCertAuth authenticates with Vault using the JWT/OIDC authentication
- method, with the role name and token stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path where the Certificate authentication backend is mounted
- in Vault, e.g: “cert”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultRole</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>VaultRole specifies the Vault role to use for TLS certificate authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientCert</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClientCert is a certificate to authenticate using the Cert Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing client private key to
- authenticate with Vault using the Cert authentication method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultCheckAndSet">VaultCheckAndSet
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultCheckAndSet defines the Check-And-Set (CAS) settings for Vault KV v2 PushSecret operations.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>required</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Required when true, all write operations must include a check-and-set parameter.
- This helps prevent unintentional overwrites of secrets.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultClientTLS">VaultClientTLS
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultClientTLS is the configuration used for client side related TLS communication,
- when the Vault server requires mutual authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CertSecretRef is a certificate added to the transport layer
- when communicating with the Vault server.
- If no key for the Secret is specified, external-secret will default to ‘tls.crt’.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeySecretRef to a key in a Secret resource containing client private key
- added to the transport layer when communicating with the Vault server.
- If no key for the Secret is specified, external-secret will default to ‘tls.key’.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultGCPAuth">VaultGCPAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultGCPAuth authenticates with Vault using Google Cloud Platform authentication method.
- Refer: <a href="https://developer.hashicorp.com/vault/docs/auth/gcp">https://developer.hashicorp.com/vault/docs/auth/gcp</a></p>
- <p>When ServiceAccountRef, SecretRef and WorkloadIdentity are not specified, the provider will use the controller pod’s
- identity to authenticate with GCP. This supports both GKE Workload Identity and service account keys.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path where the GCP auth method is enabled in Vault, e.g: “gcp”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault Role. In Vault, a role describes an identity with a set of permissions, groups, or policies you want to attach to a user of the secrets engine.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Project ID of the Google Cloud Platform project</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>location</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Location optionally defines a location/region for the secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPSMAuthSecretRef">
- GCPSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify credentials in a Secret object</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentity">
- GCPWorkloadIdentity
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify a service account with Workload Identity</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef to a service account for impersonation</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultIamAuth">VaultIamAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultIamAuth authenticates with Vault using the Vault’s AWS IAM authentication method. Refer: <a href="https://developer.hashicorp.com/vault/docs/auth/aws">https://developer.hashicorp.com/vault/docs/auth/aws</a></p>
- <p>When JWTAuth and SecretRef are not specified, the provider will use the controller pod’s
- identity to authenticate with AWS. This supports both IRSA and EKS Pod Identity.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path where the AWS auth method is enabled in Vault, e.g: “aws”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS region</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>This is the AWS role to be assumed before talking to vault</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultRole</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS External ID set on assumed IAM roles</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultAwsIamServerID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: <a href="https://developer.hashicorp.com/vault/docs/auth/aws">https://developer.hashicorp.com/vault/docs/auth/aws</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAwsAuthSecretRef">
- VaultAwsAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify credentials in a Secret object</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAwsJWTAuth">
- VaultAwsJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify a service account with IRSA enabled</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultJwtAuth">VaultJwtAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication
- method, with the role name and a token stored in a Kubernetes Secret resource or
- a Kubernetes service account token retrieved via <code>TokenRequest</code>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the JWT authentication backend is mounted
- in Vault, e.g: “jwt”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Role is a JWT role to authenticate using the JWT/OIDC Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional SecretRef that refers to a key in a Secret resource containing JWT token to
- authenticate with Vault using the JWT/OIDC authentication method.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetesServiceAccountToken</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultKubernetesServiceAccountTokenAuth">
- VaultKubernetesServiceAccountTokenAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional ServiceAccountToken specifies the Kubernetes service account for which to request
- a token for with the <code>TokenRequest</code> API.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultKVStoreVersion">VaultKVStoreVersion
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultKVStoreVersion represents the version of the Vault KV secret engine.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"v1"</p></td>
- <td></td>
- </tr><tr><td><p>"v2"</p></td>
- <td></td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultKubernetesAuth">VaultKubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultKubernetesAuth authenticates against Vault using a Kubernetes ServiceAccount token stored in
- a Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>mountPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the Kubernetes authentication backend is mounted in Vault, e.g:
- “kubernetes”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional service account field containing the name of a kubernetes ServiceAccount.
- If the service account is specified, the service account secret token JWT will be used
- for authenticating with Vault. If the service account selector is not supplied,
- the secretRef will be used instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Vault. If a name is specified without a key,
- <code>token</code> is the default. If one is not specified, the one bound to
- the controller will be used.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A required field containing the Vault Role to assume. A Role binds a
- Kubernetes ServiceAccount with a set of Vault policies.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultKubernetesServiceAccountTokenAuth">VaultKubernetesServiceAccountTokenAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultJwtAuth">VaultJwtAuth</a>)
- </p>
- <p>
- <p>VaultKubernetesServiceAccountTokenAuth authenticates with Vault using a temporary
- Kubernetes service account token retrieved by the <code>TokenRequest</code> API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Service account field containing the name of a kubernetes ServiceAccount.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>audiences</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional audiences field that will be used to request a temporary Kubernetes service
- account token for the service account referenced by <code>serviceAccountRef</code>.
- Defaults to a single audience <code>vault</code> it not specified.</p>
- <p>Deprecated: use serviceAccountRef.Audiences instead</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expirationSeconds</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional expiration time in seconds that will be used to request a temporary
- Kubernetes service account token for the service account referenced by
- <code>serviceAccountRef</code>.</p>
- <p>Deprecated: this will be removed in the future.
- Defaults to 10 minutes.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultLdapAuth">VaultLdapAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultLdapAuth authenticates with Vault using the LDAP authentication method,
- with the username and password stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the LDAP authentication backend is mounted
- in Vault, e.g: “ldap”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Username is an LDAP username used to authenticate using the LDAP Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing password for the LDAP
- user used to authenticate with Vault using the LDAP authentication
- method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultProvider">VaultProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>,
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">VaultDynamicSecretSpec</a>)
- </p>
- <p>
- <p>VaultProvider configures a store to sync secrets using a Hashicorp Vault KV backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultAuth">
- VaultAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with the Vault server.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Server is the connection address for the Vault server, e.g: “<a href="https://vault.example.com:8200"">https://vault.example.com:8200”</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path is the mount path of the Vault KV backend endpoint, e.g:
- “secret”. The v2 KV secret engine version specific “/data” path suffix
- for fetching secrets from Vault is optional and will be appended
- if not present in specified path.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultKVStoreVersion">
- VaultKVStoreVersion
- </a>
- </em>
- </td>
- <td>
- <p>Version is the Vault KV secret engine version. This can be either “v1” or
- “v2”. Version defaults to “v2”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
- Vault environments to support Secure Multi-tenancy. e.g: “ns1”.
- More about namespaces can be found here <a href="https://www.vaultproject.io/docs/enterprise/namespaces">https://www.vaultproject.io/docs/enterprise/namespaces</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate Vault server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tls</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultClientTLS">
- VaultClientTLS
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The configuration used for client side related TLS communication, when the Vault server
- requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
- This parameter is ignored for plain HTTP protocol connection.
- It’s worth noting this configuration is different from the “TLS certificates auth method”,
- which is available under the <code>auth.cert</code> section.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Vault server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>readYourWrites</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ReadYourWrites ensures isolated read-after-write semantics by
- providing discovered cluster replication states in each request.
- More information about eventual consistency in Vault can be found here
- <a href="https://www.vaultproject.io/docs/enterprise/consistency">https://www.vaultproject.io/docs/enterprise/consistency</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>forwardInconsistent</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
- leader instead of simply retrying within a loop. This can increase performance if
- the option is enabled serverside.
- <a href="https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header">https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers to be added in Vault request</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>checkAndSet</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultCheckAndSet">
- VaultCheckAndSet
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CheckAndSet defines the Check-And-Set (CAS) settings for PushSecret operations.
- Only applies to Vault KV v2 stores. When enabled, write operations must include
- the current version of the secret to prevent unintentional overwrites.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VaultUserPassAuth">VaultUserPassAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultUserPassAuth authenticates with Vault using UserPass authentication method,
- with the username and password stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the UserPassword authentication backend is mounted
- in Vault, e.g: “userpass”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Username is a username used to authenticate using the UserPass Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing password for the
- user used to authenticate with Vault using the UserPass authentication
- method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VolcengineAuth">VolcengineAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VolcengineProvider">VolcengineProvider</a>)
- </p>
- <p>
- <p>VolcengineAuth defines the authentication method for the Volcengine provider.
- Only one of the fields should be set.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.VolcengineAuthSecretRef">
- VolcengineAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef defines the static credentials to use for authentication.
- If not set, IRSA is used.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VolcengineAuthSecretRef">VolcengineAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.VolcengineAuth">VolcengineAuth</a>)
- </p>
- <p>
- <p>VolcengineAuthSecretRef defines the secret reference for static credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyID</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AccessKeyID is the reference to the secret containing the Access Key ID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretAccessKey is the reference to the secret containing the Secret Access Key.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Token is the reference to the secret containing the STS(Security Token Service) Token.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.VolcengineProvider">VolcengineProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>VolcengineProvider defines the configuration for the Volcengine provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region specifies the Volcengine region to connect to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.VolcengineAuth">
- VolcengineAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines the authentication method to use.
- If not specified, the provider will try to use IRSA (IAM Role for Service Account).</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.WebhookCAProvider">WebhookCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookCAProvider defines a location to fetch the cert for the webhook provider from.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1.WebhookCAProviderType">
- WebhookCAProviderType
- </a>
- </em>
- </td>
- <td>
- <p>The type of provider to use such as “Secret”, or “ConfigMap”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the object located at the provider type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the CA certificate can be found in the Secret or ConfigMap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The namespace the Provider type is in.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.WebhookCAProviderType">WebhookCAProviderType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.WebhookCAProvider">WebhookCAProvider</a>)
- </p>
- <p>
- <p>WebhookCAProviderType defines the type of provider for certificate authority in webhook connections.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ConfigMap"</p></td>
- <td><p>WebhookCAProviderTypeConfigMap indicates that the CA certificate is stored in a ConfigMap resource.</p>
- </td>
- </tr><tr><td><p>"Secret"</p></td>
- <td><p>WebhookCAProviderTypeSecret indicates that the CA certificate is stored in a Secret resource.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1.WebhookProvider">WebhookProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>WebhookProvider configures a store to sync secrets from simple web APIs.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook Method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook url to call</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.AuthorizationProtocol">
- AuthorizationProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth specifies a authorization protocol. Only one protocol may be set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>body</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Body</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timeout</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Timeout</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>result</code></br>
- <em>
- <a href="#external-secrets.io/v1.WebhookResult">
- WebhookResult
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Result formatting</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secrets</code></br>
- <em>
- <a href="#external-secrets.io/v1.WebhookSecret">
- []WebhookSecret
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secrets to fill in templates
- These secrets will be passed to the templating function as key value pairs under the given name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate webhook server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.WebhookCAProvider">
- WebhookCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate webhook server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.WebhookResult">WebhookResult
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookResult defines how to process and extract secrets from the webhook response.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>jsonPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Json path of return value</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.WebhookSecret">WebhookSecret
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookSecret defines a secret that will be passed to the webhook request.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of this secret in templates</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Secret ref to fill in credentials</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.YandexAuth">YandexAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.YandexCertificateManagerProvider">YandexCertificateManagerProvider</a>,
- <a href="#external-secrets.io/v1.YandexLockboxProvider">YandexLockboxProvider</a>)
- </p>
- <p>
- <p>YandexAuth defines the authentication method for the Yandex provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authorizedKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The authorized key used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.YandexCAProvider">YandexCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.YandexCertificateManagerProvider">YandexCertificateManagerProvider</a>,
- <a href="#external-secrets.io/v1.YandexLockboxProvider">YandexLockboxProvider</a>)
- </p>
- <p>
- <p>YandexCAProvider defines the configuration for Yandex custom certificate authority.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.YandexCertificateManagerProvider">YandexCertificateManagerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>YandexCertificateManagerProvider Configures a store to sync secrets using the Yandex Certificate Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexAuth">
- YandexAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Yandex.Cloud</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexCAProvider">
- YandexCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Yandex.Cloud server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fetching</code></br>
- <em>
- <a href="#external-secrets.io/v1.FetchingPolicy">
- FetchingPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>FetchingPolicy configures the provider to interpret the <code>data.secretKey.remoteRef.key</code> field in ExternalSecret as certificate ID or certificate name</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1.YandexLockboxProvider">YandexLockboxProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>YandexLockboxProvider Configures a store to sync secrets using the Yandex Lockbox provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexAuth">
- YandexAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Yandex.Cloud</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1.YandexCAProvider">
- YandexCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Yandex.Cloud server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fetching</code></br>
- <em>
- <a href="#external-secrets.io/v1.FetchingPolicy">
- FetchingPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>FetchingPolicy configures the provider to interpret the <code>data.secretKey.remoteRef.key</code> field in ExternalSecret as secret ID or secret name</p>
- </td>
- </tr>
- </tbody>
- </table>
- <hr/>
- <h2 id="external-secrets.io/v1alpha1">external-secrets.io/v1alpha1</h2>
- <p>
- <p>Package v1alpha1 contains resources for external-secrets</p>
- </p>
- <p>Resource Types:</p>
- <ul></ul>
- <h3 id="external-secrets.io/v1alpha1.ClusterPushSecret">ClusterPushSecret
- </h3>
- <p>
- <p>ClusterPushSecret is the Schema for the ClusterPushSecrets API that enables cluster-wide management of pushing Kubernetes secrets to external providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretSpec">
- ClusterPushSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>pushSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">
- PushSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>PushSecretSpec defines what to do with the secrets.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pushSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the push secrets to be created.
- Defaults to the name of the ClusterPushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pushSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretMetadata">
- PushSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretStatus">
- ClusterPushSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.ClusterPushSecretCondition">ClusterPushSecretCondition
- </h3>
- <p>
- <p>ClusterPushSecretCondition used to refine PushSecrets to specific namespaces and names.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespace using a labelSelector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.ClusterPushSecretNamespaceFailure">ClusterPushSecretNamespaceFailure
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretStatus">ClusterPushSecretStatus</a>)
- </p>
- <p>
- <p>ClusterPushSecretNamespaceFailure represents a failed namespace deployment and it’s reason.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Namespace is the namespace that failed when trying to apply an PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reason is why the PushSecret failed to apply to the namespace</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.ClusterPushSecretSpec">ClusterPushSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecret">ClusterPushSecret</a>)
- </p>
- <p>
- <p>ClusterPushSecretSpec defines the configuration for a ClusterPushSecret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>pushSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">
- PushSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>PushSecretSpec defines what to do with the secrets.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pushSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the push secrets to be created.
- Defaults to the name of the ClusterPushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pushSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretMetadata">
- PushSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.ClusterPushSecretStatus">ClusterPushSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecret">ClusterPushSecret</a>)
- </p>
- <p>
- <p>ClusterPushSecretStatus contains the status information for the ClusterPushSecret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>failedNamespaces</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretNamespaceFailure">
- []ClusterPushSecretNamespaceFailure
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Failed namespaces are the namespaces that failed to apply an PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provisionedNamespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ProvisionedNamespaces are the namespaces where the ClusterPushSecret has secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pushSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStatusCondition">
- []PushSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecret">PushSecret
- </h3>
- <p>
- <p>PushSecret is the Schema for the PushSecrets API that enables pushing Kubernetes secrets to external secret providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">
- PushSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The Interval to which External Secrets will try to push a secret definition</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretStoreRefs</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStoreRef">
- []PushSecretStoreRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>updatePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretUpdatePolicy">
- PushSecretUpdatePolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UpdatePolicy to handle Secrets in the provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>deletionPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDeletionPolicy">
- PushSecretDeletionPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Deletion Policy to handle Secrets in the provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>selector</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSelector">
- PushSecretSelector
- </a>
- </em>
- </td>
- <td>
- <p>The Secret Selector (k8s source) for the Push Secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretData">
- []PushSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secret Data that should be pushed to providers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataTo</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">
- []PushSecretDataTo
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataTo defines bulk push rules that expand source Secret keys into provider entries.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">
- ExternalSecretTemplate
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Template defines a blueprint for the created Secret resource.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStatus">
- PushSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretConditionType">PushSecretConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStatusCondition">PushSecretStatusCondition</a>)
- </p>
- <p>
- <p>PushSecretConditionType indicates the condition of the PushSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>PushSecretReady indicates the PushSecret resource is ready.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretConversionStrategy">PushSecretConversionStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretData">PushSecretData</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">PushSecretDataTo</a>)
- </p>
- <p>
- <p>PushSecretConversionStrategy defines how secret values are converted when pushed to providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"None"</p></td>
- <td><p>PushSecretConversionNone indicates no conversion will be performed on the secret value.</p>
- </td>
- </tr><tr><td><p>"ReverseUnicode"</p></td>
- <td><p>PushSecretConversionReverseUnicode indicates that unicode escape sequences will be reversed.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretData">PushSecretData
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretData defines data to be pushed to the provider and associated metadata.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>match</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretMatch">
- PushSecretMatch
- </a>
- </em>
- </td>
- <td>
- <p>Match a given Secret Key to be pushed to the provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Metadata is metadata attached to the secret.
- The structure of metadata is provider specific, please look it up in the provider documentation.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretConversionStrategy">
- PushSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy for the secret keys</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretDataTo">PushSecretDataTo
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretDataTo defines how to bulk-push secrets to providers without explicit per-key mappings.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>storeRef</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStoreRef">
- PushSecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <p>StoreRef specifies which SecretStore to push to. Required.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RemoteKey is the name of the single provider secret that will receive ALL
- matched keys bundled as a JSON object (e.g. {“DB_HOST”:“…”,“DB_USER”:“…”}).
- When set, per-key expansion is skipped and a single push is performed.
- The provider’s store prefix (if any) is still prepended to this value.
- When not set, each matched key is pushed as its own individual provider secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>match</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataToMatch">
- PushSecretDataToMatch
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Match pattern for selecting keys from the source Secret.
- If not specified, all keys are selected.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>rewrite</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretRewrite">
- []PushSecretRewrite
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Rewrite operations to transform keys before pushing to the provider.
- Operations are applied sequentially.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Metadata is metadata attached to the secret.
- The structure of metadata is provider specific, please look it up in the provider documentation.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretConversionStrategy">
- PushSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy for the secret keys</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretDataToMatch">PushSecretDataToMatch
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">PushSecretDataTo</a>)
- </p>
- <p>
- <p>PushSecretDataToMatch defines pattern matching for key selection.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Regexp matches keys by regular expression.
- If not specified, all keys are matched.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretDeletionPolicy">PushSecretDeletionPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretDeletionPolicy defines how push secrets are deleted in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Delete"</p></td>
- <td><p>PushSecretDeletionPolicyDelete deletes secrets from the provider when the PushSecret is deleted.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>PushSecretDeletionPolicyNone keeps secrets in the provider when the PushSecret is deleted.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretMatch">PushSecretMatch
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretData">PushSecretData</a>)
- </p>
- <p>
- <p>PushSecretMatch defines how a source Secret key maps to a destination in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secret Key to be pushed</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteRef</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretRemoteRef">
- PushSecretRemoteRef
- </a>
- </em>
- </td>
- <td>
- <p>Remote Refs to push to providers.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretMetadata">PushSecretMetadata
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretSpec">ClusterPushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretMetadata defines metadata fields for the PushSecret generated by the ClusterPushSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>annotations</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>labels</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretRemoteRef">PushSecretRemoteRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretMatch">PushSecretMatch</a>)
- </p>
- <p>
- <p>PushSecretRemoteRef defines the location of the secret in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>remoteKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the resulting provider secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>property</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the property in the resulting secret</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretRewrite">PushSecretRewrite
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">PushSecretDataTo</a>)
- </p>
- <p>
- <p>PushSecretRewrite defines how to transform secret keys before pushing.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteRegexp">
- ExternalSecretRewriteRegexp
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to rewrite with regular expressions.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>transform</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretRewriteTransform">
- ExternalSecretRewriteTransform
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to apply string transformation on the secrets.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretSecret">PushSecretSecret
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSelector">PushSecretSelector</a>)
- </p>
- <p>
- <p>PushSecretSecret defines a Secret that will be used as a source for pushing to providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the Secret.
- The Secret must exist in the same namespace as the PushSecret manifest.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>selector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Selector chooses secrets using a labelSelector.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretSelector">PushSecretSelector
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretSelector defines criteria for selecting the source Secret for pushing to providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secret</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSecret">
- PushSecretSecret
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Select a Secret to Push.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>generatorRef</code></br>
- <em>
- <a href="#external-secrets.io/v1.GeneratorRef">
- GeneratorRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Point to a generator to create a Secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretSpec">ClusterPushSecretSpec</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecret">PushSecret</a>)
- </p>
- <p>
- <p>PushSecretSpec configures the behavior of the PushSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The Interval to which External Secrets will try to push a secret definition</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretStoreRefs</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStoreRef">
- []PushSecretStoreRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>updatePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretUpdatePolicy">
- PushSecretUpdatePolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UpdatePolicy to handle Secrets in the provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>deletionPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDeletionPolicy">
- PushSecretDeletionPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Deletion Policy to handle Secrets in the provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>selector</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSelector">
- PushSecretSelector
- </a>
- </em>
- </td>
- <td>
- <p>The Secret Selector (k8s source) for the Push Secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretData">
- []PushSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secret Data that should be pushed to providers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataTo</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">
- []PushSecretDataTo
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataTo defines bulk push rules that expand source Secret keys into provider entries.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- <a href="#external-secrets.io/v1.ExternalSecretTemplate">
- ExternalSecretTemplate
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Template defines a blueprint for the created Secret resource.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretStatus">PushSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecret">PushSecret</a>)
- </p>
- <p>
- <p>PushSecretStatus indicates the history of the status of PushSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>refreshTime is the time and date the external secret was fetched and
- the target secret updated</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncedResourceVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SyncedResourceVersion keeps track of the last synced version.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncedPushSecrets</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.SyncedPushSecretsMap">
- SyncedPushSecretsMap
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Synced PushSecrets, including secrets that already exist in provider.
- Matches secret stores to PushSecretData that was stored to that secret store.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStatusCondition">
- []PushSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretStatusCondition">PushSecretStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.ClusterPushSecretStatus">ClusterPushSecretStatus</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretStatus">PushSecretStatus</a>)
- </p>
- <p>
- <p>PushSecretStatusCondition indicates the status of the PushSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1alpha1.PushSecretConditionType">
- PushSecretConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretStoreRef">PushSecretStoreRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretDataTo">PushSecretDataTo</a>,
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretStoreRef contains a reference on how to sync to a SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optionally, sync to the SecretStore of the given name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>labelSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optionally, sync to secret stores with label selector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kind of the SecretStore resource (SecretStore or ClusterSecretStore)</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.PushSecretUpdatePolicy">PushSecretUpdatePolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretSpec">PushSecretSpec</a>)
- </p>
- <p>
- <p>PushSecretUpdatePolicy defines how push secrets are updated in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"IfNotExists"</p></td>
- <td><p>PushSecretUpdatePolicyIfNotExists only creates secrets that don’t exist in the provider.</p>
- </td>
- </tr><tr><td><p>"Replace"</p></td>
- <td><p>PushSecretUpdatePolicyReplace replaces existing secrets in the provider.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1alpha1.SyncedPushSecretsMap">SyncedPushSecretsMap
- (<code>map[string]map[string]github.com/external-secrets/external-secrets/apis/externalsecrets/v1alpha1.PushSecretData</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1alpha1.PushSecretStatus">PushSecretStatus</a>)
- </p>
- <p>
- <p>SyncedPushSecretsMap is a map that tracks which PushSecretData was stored to which secret store.
- The outer map’s key is the secret store name, and the inner map’s key is the remote key name.</p>
- </p>
- <hr/>
- <h2 id="external-secrets.io/v1beta1">external-secrets.io/v1beta1</h2>
- <p>
- <p>Package v1beta1 contains resources for external-secrets</p>
- </p>
- <p>Resource Types:</p>
- <ul></ul>
- <h3 id="external-secrets.io/v1beta1.AWSAuth">AWSAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>AWSAuth tells the controller how to do authentication with aws.
- Only one of secretRef or jwt can be specified.
- if none is specified the controller will load credentials using the aws sdk defaults.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AWSAuthSecretRef">
- AWSAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AWSJWTAuth">
- AWSJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AWSAuthSecretRef">AWSAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSAuthSecretRef holds secret references for AWS credentials
- both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SessionToken used for authentication
- This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
- see: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AWSJWTAuth">AWSJWTAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSJWTAuth authenticates against AWS using service account tokens from the Kubernetes cluster.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AWSProvider">AWSProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AWSProvider configures a store to sync secrets with AWS.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>service</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AWSServiceType">
- AWSServiceType
- </a>
- </em>
- </td>
- <td>
- <p>Service defines which service should be used to fetch the secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines the information necessary to authenticate against AWS
- if not set aws sdk will infer credentials from your environment
- see: <a href="https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials">https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Role is a Role ARN which the provider will assume</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS Region to be used for the provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>additionalRoles</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS External ID set on assumed IAM roles</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTags</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.*github.com/external-secrets/external-secrets/apis/externalsecrets/v1beta1.Tag">
- []*github.com/external-secrets/external-secrets/apis/externalsecrets/v1beta1.Tag
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS STS assume role session tags</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretsManager</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretsManager">
- SecretsManager
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretsManager defines how the provider behaves when interacting with AWS SecretsManager</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>transitiveTagKeys</code></br>
- <em>
- []*string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS STS assume role transitive session tags. Required when multiple rules are used with the provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>prefix</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Prefix adds a prefix to all retrieved values.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AWSServiceType">AWSServiceType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>AWSServiceType is an enum that defines the service/API that is used to fetch the secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ParameterStore"</p></td>
- <td><p>AWSServiceParameterStore is the AWS SystemsManager ParameterStore service.
- see: <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html">https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html</a></p>
- </td>
- </tr><tr><td><p>"SecretsManager"</p></td>
- <td><p>AWSServiceSecretsManager is the AWS SecretsManager service.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html">https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html</a></p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AkeylessAuth">AkeylessAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AkeylessProvider">AkeylessProvider</a>)
- </p>
- <p>
- <p>AkeylessAuth defines methods of authentication with Akeyless Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AkeylessAuthSecretRef">
- AkeylessAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reference to a Secret that contains the details
- to authenticate with Akeyless.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetesAuth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AkeylessKubernetesAuth">
- AkeylessKubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes authenticates with Akeyless by passing the ServiceAccount
- token stored in the named Secret resource.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AkeylessAuthSecretRef">AkeylessAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AkeylessAuth">AkeylessAuth</a>)
- </p>
- <p>
- <p>AkeylessAuthSecretRef defines how to authenticate using a secret reference.
- AKEYLESS_ACCESS_TYPE_PARAM: AZURE_OBJ_ID OR GCP_AUDIENCE OR ACCESS_KEY OR KUB_CONFIG_NAME.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessID</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessType</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessTypeParam</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AkeylessKubernetesAuth">AkeylessKubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AkeylessAuth">AkeylessAuth</a>)
- </p>
- <p>
- <p>AkeylessKubernetesAuth authenticates with Akeyless using a Kubernetes ServiceAccount token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the Akeyless Kubernetes auth-method access-id</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>k8sConfName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Kubernetes-auth configuration name in Akeyless-Gateway</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional service account field containing the name of a kubernetes ServiceAccount.
- If the service account is specified, the service account secret token JWT will be used
- for authenticating with Akeyless. If the service account selector is not supplied,
- the secretRef will be used instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Akeyless. If a name is specified without a key,
- <code>token</code> is the default. If one is not specified, the one bound to
- the controller will be used.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AkeylessProvider">AkeylessProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AkeylessProvider Configures an store to sync secrets using Akeyless KV.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>akeylessGWApiURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Akeyless GW API Url from which the secrets to be fetched from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authSecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AkeylessAuth">
- AkeylessAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the operator authenticates with Akeyless.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
- if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Akeyless Gateway certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AlibabaAuth">AlibabaAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AlibabaProvider">AlibabaProvider</a>)
- </p>
- <p>
- <p>AlibabaAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AlibabaAuthSecretRef">
- AlibabaAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>rrsa</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AlibabaRRSAAuth">
- AlibabaRRSAAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AlibabaAuthSecretRef">AlibabaAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AlibabaAuth">AlibabaAuth</a>)
- </p>
- <p>
- <p>AlibabaAuthSecretRef holds secret references for Alibaba credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessKeySecretSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeySecret is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AlibabaProvider">AlibabaProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AlibabaProvider configures a store to sync secrets using the Alibaba Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AlibabaAuth">
- AlibabaAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>regionID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Alibaba Region to be used for the provider</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AlibabaRRSAAuth">AlibabaRRSAAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AlibabaAuth">AlibabaAuth</a>)
- </p>
- <p>
- <p>AlibabaRRSAAuth authenticates against Alibaba using RRSA (Resource-oriented RAM-based Service Authentication).</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>oidcProviderArn</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>oidcTokenFilePath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleArn</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AuthorizationProtocol">AuthorizationProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>AuthorizationProtocol contains the protocol-specific configuration</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>ntlm</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.NTLMProtocol">
- NTLMProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>NTLMProtocol configures the store to use NTLM for auth</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AzureAuthType">AzureAuthType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureAuthType describes how to authenticate to the Azure Keyvault.
- Only one of the following auth types may be specified.
- If none of the following auth type is specified, the default one
- is ServicePrincipal.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ManagedIdentity"</p></td>
- <td><p>AzureManagedIdentity uses Managed Identity to authenticate. Used with aad-pod-identity installed in the cluster.</p>
- </td>
- </tr><tr><td><p>"ServicePrincipal"</p></td>
- <td><p>AzureServicePrincipal uses service principal to authenticate, which needs a tenantId, a clientId and a clientSecret.</p>
- </td>
- </tr><tr><td><p>"WorkloadIdentity"</p></td>
- <td><p>AzureWorkloadIdentity uses Workload Identity service accounts to authenticate.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AzureEnvironmentType">AzureEnvironmentType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureEnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ChinaCloud"</p></td>
- <td><p>AzureEnvironmentChinaCloud represents the Azure China cloud environment.</p>
- </td>
- </tr><tr><td><p>"GermanCloud"</p></td>
- <td><p>AzureEnvironmentGermanCloud represents the Azure German cloud environment.</p>
- </td>
- </tr><tr><td><p>"PublicCloud"</p></td>
- <td><p>AzureEnvironmentPublicCloud represents the Azure public cloud environment.</p>
- </td>
- </tr><tr><td><p>"USGovernmentCloud"</p></td>
- <td><p>AzureEnvironmentUSGovernmentCloud represents the Azure US government cloud environment.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AzureKVAuth">AzureKVAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AzureKVProvider">AzureKVProvider</a>)
- </p>
- <p>
- <p>AzureKVAuth defines configuration for authentication with Azure Key Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure clientId of the service principle or managed identity used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure tenantId of the managed identity used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure ClientSecret of the service principle used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientCertificate</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The Azure ClientCertificate of the service principle used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.AzureKVProvider">AzureKVProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>AzureKVProvider configures a store to sync secrets using Azure Key Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authType</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AzureAuthType">
- AzureAuthType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth type defines how to authenticate to the keyvault service.
- Valid values are:
- - “ServicePrincipal” (default): Using a service principal (tenantId, clientId, clientSecret)
- - “ManagedIdentity”: Using Managed Identity assigned to the pod (see aad-pod-identity)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault Url from which the secrets to be fetched from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentType</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AzureEnvironmentType">
- AzureEnvironmentType
- </a>
- </em>
- </td>
- <td>
- <p>EnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authSecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AzureKVAuth">
- AzureKVAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specified the service account
- that should be used when authenticating with WorkloadIdentity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>If multiple Managed Identity is assigned to the pod, you can select the one to be used</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">BeyondTrustProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustAuth">BeyondtrustAuth</a>)
- </p>
- <p>
- <p>BeyondTrustProviderSecretRef defines a reference to a secret containing credentials for the BeyondTrust provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BeyondtrustAuth">BeyondtrustAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustProvider">BeyondtrustProvider</a>)
- </p>
- <p>
- <p>BeyondtrustAuth configures authentication for BeyondTrust Password Safe.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiKey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>APIKey If not provided then ClientID/ClientSecret become required.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientID is the API OAuth Client ID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientSecret is the API OAuth Client Secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>certificate</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>certificateKey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondTrustProviderSecretRef">
- BeyondTrustProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Certificate private key (key.pem). For use when authenticating with an OAuth client Id</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BeyondtrustProvider">BeyondtrustProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>BeyondtrustProvider defines configuration for the BeyondTrust Password Safe provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustAuth">
- BeyondtrustAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the operator authenticates with Beyondtrust.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustServer">
- BeyondtrustServer
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how API server works.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BeyondtrustServer">BeyondtrustServer
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustProvider">BeyondtrustProvider</a>)
- </p>
- <p>
- <p>BeyondtrustServer defines configuration for connecting to BeyondTrust Password Safe server.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrievalType</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>separator</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A character that separates the folder names.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decrypt</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>When true, the response includes the decrypted password. When false, the password field is omitted. This option only applies to the SECRET retrieval type. Default: true.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>verifyCA</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientTimeOutSeconds</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BitwardenSecretsManagerAuth">BitwardenSecretsManagerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerAuth contains the ref to the secret that contains the machine account token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerSecretRef">
- BitwardenSecretsManagerSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerProvider configures a store to sync secrets with a Bitwarden Secrets Manager instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>identityURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>bitwardenServerSDKURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
- can be performed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organizationID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>OrganizationID determines which organization this secret store manages.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID determines which project this secret store manages.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerAuth">
- BitwardenSecretsManagerAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a bitwarden machine account instance.
- Make sure that the token being used has permissions on the given secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.BitwardenSecretsManagerSecretRef">BitwardenSecretsManagerSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerAuth">BitwardenSecretsManagerAuth</a>)
- </p>
- <p>
- <p>BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credentials</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AccessToken used for the bitwarden instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CAProvider">CAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AkeylessProvider">AkeylessProvider</a>,
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerProvider">BitwardenSecretsManagerProvider</a>,
- <a href="#external-secrets.io/v1beta1.ConjurProvider">ConjurProvider</a>,
- <a href="#external-secrets.io/v1beta1.GitlabProvider">GitlabProvider</a>,
- <a href="#external-secrets.io/v1beta1.KubernetesServer">KubernetesServer</a>,
- <a href="#external-secrets.io/v1beta1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>CAProvider provides custom certificate authority (CA) certificates
- for a secret store. The CAProvider points to a Secret or ConfigMap resource
- that contains a PEM-encoded certificate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProviderType">
- CAProviderType
- </a>
- </em>
- </td>
- <td>
- <p>The type of provider to use such as “Secret”, or “ConfigMap”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the object located at the provider type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the CA certificate can be found in the Secret or ConfigMap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The namespace the Provider type is in.
- Can only be defined when used in a ClusterSecretStore.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CAProviderType">CAProviderType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.CAProvider">CAProvider</a>)
- </p>
- <p>
- <p>CAProviderType defines the type of provider to use for CA certificates.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ConfigMap"</p></td>
- <td><p>CAProviderTypeConfigMap indicates that the CA certificate is stored in a ConfigMap.</p>
- </td>
- </tr><tr><td><p>"Secret"</p></td>
- <td><p>CAProviderTypeSecret indicates that the CA certificate is stored in a Secret.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CSMAuth">CSMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.CloudruSMProvider">CloudruSMProvider</a>)
- </p>
- <p>
- <p>CSMAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CSMAuthSecretRef">
- CSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CSMAuthSecretRef">CSMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.CSMAuth">CSMAuth</a>)
- </p>
- <p>
- <p>CSMAuthSecretRef holds secret references for Cloud.ru credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessKeySecretSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeySecret is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CertAuth">CertAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.KubernetesAuth">KubernetesAuth</a>)
- </p>
- <p>
- <p>CertAuth defines certificate-based authentication for the Kubernetes provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientCert</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ChefAuth">ChefAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ChefProvider">ChefProvider</a>)
- </p>
- <p>
- <p>ChefAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ChefAuthSecretRef">
- ChefAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ChefAuthSecretRef">ChefAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ChefAuth">ChefAuth</a>)
- </p>
- <p>
- <p>ChefAuthSecretRef holds secret references for chef server login credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privateKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretKey is the Signing Key in PEM format, used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ChefProvider">ChefProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ChefProvider configures a store to sync secrets using basic chef server connection credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ChefAuth">
- ChefAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against chef Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>UserName should be the user ID on the chef server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serverUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a “/”</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.CloudruSMProvider">CloudruSMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>CloudruSMProvider configures a store to sync secrets using the Cloud.ru Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CSMAuth">
- CSMAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID is the project, which the secrets are stored in.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecret">ClusterExternalSecret
- </h3>
- <p>
- <p>ClusterExternalSecret is the schema for the clusterexternalsecrets API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretSpec">
- ClusterExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>externalSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>The spec for the ExternalSecrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the external secrets to be created.
- Defaults to the name of the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretMetadata">
- ExternalSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <p>The labels to select by to find the Namespaces to create the ExternalSecrets in</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretStatus">
- ClusterExternalSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecretConditionType">ClusterExternalSecretConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretStatusCondition">ClusterExternalSecretStatusCondition</a>)
- </p>
- <p>
- <p>ClusterExternalSecretConditionType indicates the condition of the ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>ClusterExternalSecretReady indicates the ClusterExternalSecret resource is ready.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecretNamespaceFailure">ClusterExternalSecretNamespaceFailure
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretStatus">ClusterExternalSecretStatus</a>)
- </p>
- <p>
- <p>ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it’s reason.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Namespace is the namespace that failed when trying to apply an ExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reason is why the ExternalSecret failed to apply to the namespace</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecretSpec">ClusterExternalSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecret">ClusterExternalSecret</a>)
- </p>
- <p>
- <p>ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>externalSecretSpec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <p>The spec for the ExternalSecrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the external secrets to be created.
- Defaults to the name of the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalSecretMetadata</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretMetadata">
- ExternalSecretMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The metadata of the external secrets to be created</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <p>The labels to select by to find the Namespaces to create the ExternalSecrets in</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceSelectors</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#*k8s.io/apimachinery/pkg/apis/meta/v1.labelselector--">
- []*k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.</p>
- <p>Deprecated: Use NamespaceSelectors instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>The time in which the controller should reconcile its objects and recheck namespaces for labels.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecretStatus">ClusterExternalSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecret">ClusterExternalSecret</a>)
- </p>
- <p>
- <p>ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>externalSecretName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ExternalSecretName is the name of the ExternalSecrets created by the ClusterExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>failedNamespaces</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretNamespaceFailure">
- []ClusterExternalSecretNamespaceFailure
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Failed namespaces are the namespaces that failed to apply an ExternalSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provisionedNamespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretStatusCondition">
- []ClusterExternalSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterExternalSecretStatusCondition">ClusterExternalSecretStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretStatus">ClusterExternalSecretStatus</a>)
- </p>
- <p>
- <p>ClusterExternalSecretStatusCondition indicates the status of the ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretConditionType">
- ClusterExternalSecretConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterSecretStore">ClusterSecretStore
- </h3>
- <p>
- <p>ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of <code>storeRef</code> fields.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreSpec">
- SecretStoreSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatus">
- SecretStoreStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ClusterSecretStoreCondition">ClusterSecretStoreCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreSpec">SecretStoreSpec</a>)
- </p>
- <p>
- <p>ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
- for a ClusterSecretStore instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespaceSelector</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#labelselector-v1-meta">
- Kubernetes meta/v1.LabelSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespace using a labelSelector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaces</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespaceRegexes</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Choose namespaces by using regex matching</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ConjurAPIKey">ConjurAPIKey
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ConjurAuth">ConjurAuth</a>)
- </p>
- <p>
- <p>ConjurAPIKey defines authentication using a Conjur API key.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>account</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Account is the Conjur organization account name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>userRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>A reference to a specific ‘key’ containing the Conjur username
- within a Secret resource. In some instances, <code>key</code> is a required field.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiKeyRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>A reference to a specific ‘key’ containing the Conjur API key
- within a Secret resource. In some instances, <code>key</code> is a required field.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ConjurAuth">ConjurAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ConjurProvider">ConjurProvider</a>)
- </p>
- <p>
- <p>ConjurAuth defines the methods of authentication with Conjur.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apikey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ConjurAPIKey">
- ConjurAPIKey
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Authenticates with Conjur using an API key.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ConjurJWT">
- ConjurJWT
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Jwt enables JWT authentication using Kubernetes service account tokens.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ConjurJWT">ConjurJWT
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ConjurAuth">ConjurAuth</a>)
- </p>
- <p>
- <p>ConjurJWT defines authentication using a JWT service account token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>account</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Account is the Conjur organization account name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The conjur authn jwt webservice id</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>hostId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional HostID for JWT authentication. This may be used depending
- on how the Conjur JWT authenticator policy is configured.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional SecretRef that refers to a key in a Secret resource containing JWT token to
- authenticate with Conjur using the JWT authentication method.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional ServiceAccountRef specifies the Kubernetes service account for which to request
- a token for with the <code>TokenRequest</code> API.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ConjurProvider">ConjurProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ConjurProvider defines configuration for the CyberArk Conjur provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL is the endpoint of the Conjur instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to provide custom certificate authority (CA) certificates
- for a secret store. The CAProvider points to a Secret or ConfigMap resource
- that contains a PEM-encoded certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ConjurAuth">
- ConjurAuth
- </a>
- </em>
- </td>
- <td>
- <p>Defines authentication settings for connecting to Conjur.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.DelineaProvider">DelineaProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>DelineaProvider defines configuration for the Delinea DevOps Secrets Vault provider.
- See <a href="https://github.com/DelineaXPM/dsv-sdk-go/blob/main/vault/vault.go">https://github.com/DelineaXPM/dsv-sdk-go/blob/main/vault/vault.go</a>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DelineaProviderSecretRef">
- DelineaProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientID is the non-secret part of the credential.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DelineaProviderSecretRef">
- DelineaProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>ClientSecret is the secret part of the credential.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenant</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Tenant is the chosen hostname / site name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>urlTemplate</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>URLTemplate
- If unset, defaults to “https://%s.secretsvaultcloud.%s/v1/%s%s”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tld</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TLD is based on the server location that was chosen during provisioning.
- If unset, defaults to “com”.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.DelineaProviderSecretRef">DelineaProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.DelineaProvider">DelineaProvider</a>)
- </p>
- <p>
- <p>DelineaProviderSecretRef defines a reference to a secret containing credentials for the Delinea provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.Device42Auth">Device42Auth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.Device42Provider">Device42Provider</a>)
- </p>
- <p>
- <p>Device42Auth defines the authentication method for the Device42 provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.Device42SecretRef">
- Device42SecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.Device42Provider">Device42Provider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>Device42Provider configures a store to sync secrets with a Device42 instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>host</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Device42 instance URL.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.Device42Auth">
- Device42Auth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a Device42 instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.Device42SecretRef">Device42SecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.Device42Auth">Device42Auth</a>)
- </p>
- <p>
- <p>Device42SecretRef defines a reference to a secret containing credentials for the Device42 provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credentials</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username / Password is used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.DopplerAuth">DopplerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.DopplerProvider">DopplerProvider</a>)
- </p>
- <p>
- <p>DopplerAuth defines the authentication method for the Doppler provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DopplerAuthSecretRef">
- DopplerAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.DopplerAuthSecretRef">DopplerAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.DopplerAuth">DopplerAuth</a>)
- </p>
- <p>
- <p>DopplerAuthSecretRef defines a reference to a secret containing credentials for the Doppler provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>dopplerToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The DopplerToken is used for authentication.
- See <a href="https://docs.doppler.com/reference/api#authentication">https://docs.doppler.com/reference/api#authentication</a> for auth token types.
- The Key attribute defaults to dopplerToken if not specified.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.DopplerProvider">DopplerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>DopplerProvider configures a store to sync secrets using the Doppler provider.
- Project and Config are required if not using a Service Token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DopplerAuth">
- DopplerAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Doppler API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler project (required if not using a Service Token)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>config</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler config (required if not using a Service Token)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>nameTransformer</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Environment variable compatible name transforms that change secret names to a different format</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>format</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Format enables the downloading of secrets as a file (string)</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecret">ExternalSecret
- </h3>
- <p>
- <p>ExternalSecret is the schema for the external-secrets API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">
- ExternalSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>secretStoreRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTarget">
- ExternalSecretTarget
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRefreshPolicy">
- ExternalSecretRefreshPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RefreshPolicy determines how the ExternalSecret should be refreshed:
- - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
- - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
- No periodic updates occur if refreshInterval is 0.
- - OnChange: Only synchronizes the Secret when the ExternalSecret’s metadata or specification changes</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
- specified as Golang Duration strings.
- Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”
- Example values: “1h0m0s”, “2h30m0s”, “10m0s”
- May be set to “0s” to fetch and create it once. Defaults to 1h0m0s.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretData">
- []ExternalSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Data defines the connection between the Kubernetes Secret keys and the Provider data</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">
- []ExternalSecretDataFromRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataFrom is used to fetch all properties from a specific Provider data
- If multiple entries are specified, the Secret keys are merged in the specified order</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretStatus">
- ExternalSecretStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretConditionType">ExternalSecretConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretStatusCondition">ExternalSecretStatusCondition</a>)
- </p>
- <p>
- <p>ExternalSecretConditionType defines the condition type for an ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Deleted"</p></td>
- <td><p>ExternalSecretDeleted indicates the ExternalSecret has been deleted.</p>
- </td>
- </tr><tr><td><p>"Ready"</p></td>
- <td><p>ExternalSecretReady indicates the ExternalSecret has been successfully reconciled.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretConversionStrategy">ExternalSecretConversionStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>,
- <a href="#external-secrets.io/v1beta1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>ExternalSecretConversionStrategy defines how secret values are converted.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Default"</p></td>
- <td><p>ExternalSecretConversionDefault indicates the default conversion strategy.</p>
- </td>
- </tr><tr><td><p>"Unicode"</p></td>
- <td><p>ExternalSecretConversionUnicode indicates that unicode conversion will be performed.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretCreationPolicy">ExternalSecretCreationPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Merge"</p></td>
- <td><p>CreatePolicyMerge does not create the Secret, but merges the data fields to the Secret.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>CreatePolicyNone does not create a Secret (future use with injector).</p>
- </td>
- </tr><tr><td><p>"Orphan"</p></td>
- <td><p>CreatePolicyOrphan creates the Secret and does not set the ownerReference.
- I.e. it will be orphaned after the deletion of the ExternalSecret.</p>
- </td>
- </tr><tr><td><p>"Owner"</p></td>
- <td><p>CreatePolicyOwner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretData">ExternalSecretData
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key in the Kubernetes Secret to store the value.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">
- ExternalSecretDataRemoteRef
- </a>
- </em>
- </td>
- <td>
- <p>RemoteRef points to the remote secret and defines
- which secret (version/property/..) to fetch.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sourceRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.StoreSourceRef">
- StoreSourceRef
- </a>
- </em>
- </td>
- <td>
- <p>SourceRef allows you to override the source
- from which the value will be pulled.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretDataFromRemoteRef defines a reference to multiple secrets in the provider to be fetched using options.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>extract</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">
- ExternalSecretDataRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to extract multiple key/value pairs from one secret
- Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>find</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretFind">
- ExternalSecretFind
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to find secrets based on tags or regular expressions
- Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>rewrite</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRewrite">
- []ExternalSecretRewrite
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to rewrite secret Keys after getting them from the secret Provider
- Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sourceRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.StoreGeneratorSourceRef">
- StoreGeneratorSourceRef
- </a>
- </em>
- </td>
- <td>
- <p>SourceRef points to a store or generator
- which contains secret values ready to use.
- Use this in combination with Extract or Find pull values out of
- a specific SecretStore.
- When sourceRef points to a generator Extract or Find is not supported.
- The generator returns a static map of values</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretData">ExternalSecretData</a>,
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretDataRemoteRef defines Provider data location.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Key is the key used in the Provider, mandatory</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadataPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretMetadataPolicy">
- ExternalSecretMetadataPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>property</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select a specific property of the Provider value (if a map), if supported</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select a specific version of the Provider value, if supported</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretConversionStrategy">
- ExternalSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decodingStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDecodingStrategy">
- ExternalSecretDecodingStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a decoding Strategy</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretDecodingStrategy">ExternalSecretDecodingStrategy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>,
- <a href="#external-secrets.io/v1beta1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>ExternalSecretDecodingStrategy defines how secret values are decoded.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Auto"</p></td>
- <td><p>ExternalSecretDecodeAuto indicates that the decoding strategy will be automatically determined.</p>
- </td>
- </tr><tr><td><p>"Base64"</p></td>
- <td><p>ExternalSecretDecodeBase64 indicates that base64 decoding will be used.</p>
- </td>
- </tr><tr><td><p>"Base64URL"</p></td>
- <td><p>ExternalSecretDecodeBase64URL indicates that base64url decoding will be used.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>ExternalSecretDecodeNone indicates that no decoding will be performed.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretDeletionPolicy">ExternalSecretDeletionPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ExternalSecretDeletionPolicy defines rules on how to delete the resulting Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Delete"</p></td>
- <td><p>DeletionPolicyDelete deletes the secret if all provider secrets are deleted.
- If a secret gets deleted on the provider side and is not accessible
- anymore this is not considered an error and the ExternalSecret
- does not go into SecretSyncedError status.</p>
- </td>
- </tr><tr><td><p>"Merge"</p></td>
- <td><p>DeletionPolicyMerge removes keys in the secret, but not the secret itself.
- If a secret gets deleted on the provider side and is not accessible
- anymore this is not considered an error and the ExternalSecret
- does not go into SecretSyncedError status.</p>
- </td>
- </tr><tr><td><p>"Retain"</p></td>
- <td><p>DeletionPolicyRetain will retain the secret if all provider secrets have been deleted.
- If a provider secret does not exist the ExternalSecret gets into the
- SecretSyncedError status.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretFind">ExternalSecretFind
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretFind defines criteria for finding secrets in the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A root path to start the find operations.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.FindName">
- FindName
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Finds secrets based on the name.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tags</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Find secrets based on tags.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conversionStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretConversionStrategy">
- ExternalSecretConversionStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a conversion Strategy</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>decodingStrategy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDecodingStrategy">
- ExternalSecretDecodingStrategy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to define a decoding Strategy</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretMetadata">ExternalSecretMetadata
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretSpec">ClusterExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretMetadata defines metadata fields for the ExternalSecret generated by the ClusterExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>annotations</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>labels</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretMetadataPolicy">ExternalSecretMetadataPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataRemoteRef">ExternalSecretDataRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretMetadataPolicy defines the policy for fetching tags/labels from provider secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Fetch"</p></td>
- <td><p>ExternalSecretMetadataPolicyFetch indicates that metadata will be fetched from the provider.</p>
- </td>
- </tr><tr><td><p>"None"</p></td>
- <td><p>ExternalSecretMetadataPolicyNone indicates that no metadata will be fetched.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretRefreshPolicy">ExternalSecretRefreshPolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretRefreshPolicy defines how and when the ExternalSecret should be refreshed.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"CreatedOnce"</p></td>
- <td><p>RefreshPolicyCreatedOnce creates the Secret only if it does not exist and does not update it thereafter.</p>
- </td>
- </tr><tr><td><p>"OnChange"</p></td>
- <td><p>RefreshPolicyOnChange only synchronizes the Secret when the ExternalSecret’s metadata or specification changes.</p>
- </td>
- </tr><tr><td><p>"Periodic"</p></td>
- <td><p>RefreshPolicyPeriodic synchronizes the Secret from the external source at regular intervals.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretRewrite">ExternalSecretRewrite
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>ExternalSecretRewrite defines rules on how to rewrite secret keys.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRewriteRegexp">
- ExternalSecretRewriteRegexp
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to rewrite with regular expressions.
- The resulting key will be the output of a regexp.ReplaceAll operation.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>transform</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRewriteTransform">
- ExternalSecretRewriteTransform
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to apply string transformation on the secrets.
- The resulting key will be the output of the template applied by the operation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretRewriteRegexp">ExternalSecretRewriteRegexp
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRewrite">ExternalSecretRewrite</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteRegexp defines how to use regular expressions for rewriting secret keys.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>source</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the regular expression of a re.Compiler.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the target pattern of a ReplaceAll operation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretRewriteTransform">ExternalSecretRewriteTransform
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRewrite">ExternalSecretRewrite</a>)
- </p>
- <p>
- <p>ExternalSecretRewriteTransform defines how to use string templates for transforming secret keys.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Used to define the template to apply on the secret name.
- <code>.value</code> will specify the secret name in the template.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterExternalSecretSpec">ClusterExternalSecretSpec</a>,
- <a href="#external-secrets.io/v1beta1.ExternalSecret">ExternalSecret</a>)
- </p>
- <p>
- <p>ExternalSecretSpec defines the desired state of ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretStoreRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTarget">
- ExternalSecretTarget
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretRefreshPolicy">
- ExternalSecretRefreshPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RefreshPolicy determines how the ExternalSecret should be refreshed:
- - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
- - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
- No periodic updates occur if refreshInterval is 0.
- - OnChange: Only synchronizes the Secret when the ExternalSecret’s metadata or specification changes</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <p>RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
- specified as Golang Duration strings.
- Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”
- Example values: “1h0m0s”, “2h30m0s”, “10m0s”
- May be set to “0s” to fetch and create it once. Defaults to 1h0m0s.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretData">
- []ExternalSecretData
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Data defines the connection between the Kubernetes Secret keys and the Provider data</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>dataFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">
- []ExternalSecretDataFromRemoteRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DataFrom is used to fetch all properties from a specific Provider data
- If multiple entries are specified, the Secret keys are merged in the specified order</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretStatus">ExternalSecretStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecret">ExternalSecret</a>)
- </p>
- <p>
- <p>ExternalSecretStatus defines the observed state of ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>refreshTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>refreshTime is the time and date the external secret was fetched and
- the target secret updated</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>syncedResourceVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SyncedResourceVersion keeps track of the last synced version</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretStatusCondition">
- []ExternalSecretStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>binding</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#localobjectreference-v1-core">
- Kubernetes core/v1.LocalObjectReference
- </a>
- </em>
- </td>
- <td>
- <p>Binding represents a servicebinding.io Provisioned Service reference to the secret</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretStatusCondition">ExternalSecretStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretStatus">ExternalSecretStatus</a>)
- </p>
- <p>
- <p>ExternalSecretStatusCondition contains condition information for an ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretConditionType">
- ExternalSecretConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretTarget">ExternalSecretTarget
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec</a>)
- </p>
- <p>
- <p>ExternalSecretTarget defines the Kubernetes Secret to be created
- There can be only one target per ExternalSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The name of the Secret resource to be managed.
- Defaults to the .metadata.name of the ExternalSecret resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>creationPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretCreationPolicy">
- ExternalSecretCreationPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CreationPolicy defines rules on how to create the resulting Secret.
- Defaults to “Owner”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>deletionPolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDeletionPolicy">
- ExternalSecretDeletionPolicy
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>DeletionPolicy defines rules on how to delete the resulting Secret.
- Defaults to “Retain”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>template</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplate">
- ExternalSecretTemplate
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Template defines a blueprint for the created Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>immutable</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Immutable defines if the final secret will be immutable</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretTemplate">ExternalSecretTemplate
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTarget">ExternalSecretTarget</a>)
- </p>
- <p>
- <p>ExternalSecretTemplate defines a blueprint for the created Secret resource.
- we can not use native corev1.Secret, it will have empty ObjectMeta values: <a href="https://github.com/kubernetes-sigs/controller-tools/issues/448">https://github.com/kubernetes-sigs/controller-tools/issues/448</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#secrettype-v1-core">
- Kubernetes core/v1.SecretType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>engineVersion</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateEngineVersion">
- TemplateEngineVersion
- </a>
- </em>
- </td>
- <td>
- <p>EngineVersion specifies the template engine version
- that should be used to compile/execute the
- template specified in .data and .templateFrom[].</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplateMetadata">
- ExternalSecretTemplateMetadata
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>mergePolicy</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateMergePolicy">
- TemplateMergePolicy
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>templateFrom</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateFrom">
- []TemplateFrom
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretTemplateMetadata">ExternalSecretTemplateMetadata
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>annotations</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>labels</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ExternalSecretValidator">ExternalSecretValidator
- </h3>
- <p>
- <p>ExternalSecretValidator implements a validating webhook for ExternalSecrets.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.FakeProvider">FakeProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>FakeProvider configures a fake provider that returns static values.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.FakeProviderData">
- []FakeProviderData
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.FakeProviderData">FakeProviderData
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.FakeProvider">FakeProvider</a>)
- </p>
- <p>
- <p>FakeProviderData defines a key-value pair for the fake provider used in testing.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.FindName">FindName
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretFind">ExternalSecretFind</a>)
- </p>
- <p>
- <p>FindName defines name matching criteria for finding secrets.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>regexp</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Finds secrets base</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.FortanixProvider">FortanixProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>FortanixProvider configures a store to sync secrets using the Fortanix SDKMS provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the URL of SDKMS API. Defaults to <code>sdkms.fortanix.com</code>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiKey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.FortanixProviderSecretRef">
- FortanixProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>APIKey is the API token to access SDKMS Applications.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.FortanixProviderSecretRef">FortanixProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.FortanixProvider">FortanixProvider</a>)
- </p>
- <p>
- <p>FortanixProviderSecretRef defines a reference to a secret containing credentials for the Fortanix provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef is a reference to a secret containing the SDKMS API Key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GCPSMAuth">GCPSMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GCPSMProvider">GCPSMProvider</a>)
- </p>
- <p>
- <p>GCPSMAuth defines the authentication methods for the GCP Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GCPSMAuthSecretRef">
- GCPSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GCPWorkloadIdentity">
- GCPWorkloadIdentity
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GCPSMAuthSecretRef">GCPSMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GCPSMAuth">GCPSMAuth</a>)
- </p>
- <p>
- <p>GCPSMAuthSecretRef defines a reference to a secret containing credentials for the GCP Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GCPSMProvider">GCPSMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GCPSMProvider Configures a store to sync secrets using the GCP Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GCPSMAuth">
- GCPSMAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines the information necessary to authenticate against GCP</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID project where secret is located</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>location</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Location optionally defines a location for a secret</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GCPWorkloadIdentity">GCPWorkloadIdentity
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GCPSMAuth">GCPSMAuth</a>)
- </p>
- <p>
- <p>GCPWorkloadIdentity defines configuration for using GCP Workload Identity authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterLocation</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterLocation is the location of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterName is the name of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterProjectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClusterProjectID is the project ID of the cluster
- If not specified, it fetches information from the metadata server</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GeneratorRef">GeneratorRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.StoreGeneratorSourceRef">StoreGeneratorSourceRef</a>,
- <a href="#external-secrets.io/v1beta1.StoreSourceRef">StoreSourceRef</a>)
- </p>
- <p>
- <p>GeneratorRef points to a generator custom resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiVersion</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the apiVersion of the generator resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the Kind of the generator resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Specify the name of the generator resource</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GenericClusterStoreValidator">GenericClusterStoreValidator
- </h3>
- <p>
- <p>GenericClusterStoreValidator provides validation for ClusterSecretStore resources.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.GenericStore">GenericStore
- </h3>
- <p>
- <p>GenericStore is a common interface for interacting with ClusterSecretStore
- or a namespaced SecretStore.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.GenericStoreValidator">GenericStoreValidator
- </h3>
- <p>
- <p>GenericStoreValidator provides validation for SecretStore resources.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.GithubAppAuth">GithubAppAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GithubProvider">GithubProvider</a>)
- </p>
- <p>
- <p>GithubAppAuth defines the GitHub App authentication mechanism for the GitHub provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privateKey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GithubProvider">GithubProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GithubProvider configures a store to push secrets to Github Actions.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Github instance URL. Defaults to <a href="https://github.com/">https://github.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>uploadURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Upload URL for enterprise instances. Default to URL.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GithubAppAuth">
- GithubAppAuth
- </a>
- </em>
- </td>
- <td>
- <p>auth configures how secret-manager authenticates with a Github instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appID</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <p>appID specifies the Github APP that will be used to authenticate the client</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>installationID</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <p>installationID specifies the Github APP installation that will be used to authenticate the client</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organization</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>organization will be used to fetch secrets from the Github organization</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>repository</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>repository will be used to fetch secrets from the Github repository within an organization</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>environment will be used to fetch secrets from a particular environment within a github repository</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GitlabAuth">GitlabAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GitlabProvider">GitlabProvider</a>)
- </p>
- <p>
- <p>GitlabAuth defines the authentication method for the GitLab provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>SecretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GitlabSecretRef">
- GitlabSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GitlabProvider">GitlabProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>GitlabProvider configures a store to sync secrets with a GitLab instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the GitLab instance URL. Defaults to <a href="https://gitlab.com/">https://gitlab.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GitlabAuth">
- GitlabAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a GitLab instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID specifies a project where secrets are located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>inheritFromGroups</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>groupIDs</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <p>GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment environment_scope of gitlab CI/CD variables (Please see <a href="https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment">https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment</a> on how to create environments)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Base64 encoded certificate for the GitLab server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
- can be performed.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.GitlabSecretRef">GitlabSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.GitlabAuth">GitlabAuth</a>)
- </p>
- <p>
- <p>GitlabSecretRef defines a reference to a secret containing credentials for the GitLab provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>AccessToken is used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.IBMAuth">IBMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.IBMProvider">IBMProvider</a>)
- </p>
- <p>
- <p>IBMAuth defines the authentication methods for the IBM Cloud Secrets Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.IBMAuthSecretRef">
- IBMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>containerAuth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.IBMAuthContainerAuth">
- IBMAuthContainerAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.IBMAuthContainerAuth">IBMAuthContainerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.IBMAuth">IBMAuth</a>)
- </p>
- <p>
- <p>IBMAuthContainerAuth defines authentication using IBM Container-based auth with IAM Trusted Profile.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>profile</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the IBM Trusted Profile</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenLocation</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Location the token is mounted on the pod</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iamEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.IBMAuthSecretRef">IBMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.IBMAuth">IBMAuth</a>)
- </p>
- <p>
- <p>IBMAuthSecretRef defines a reference to a secret containing credentials for the IBM provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretApiKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.IBMProvider">IBMProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>IBMProvider configures a store to sync secrets using a IBM Cloud Secrets Manager backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.IBMAuth">
- IBMAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with the IBM secrets manager.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.InfisicalAuth">InfisicalAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.InfisicalProvider">InfisicalProvider</a>)
- </p>
- <p>
- <p>InfisicalAuth defines the authentication methods for the Infisical provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>universalAuthCredentials</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.UniversalAuthCredentials">
- UniversalAuthCredentials
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.InfisicalProvider">InfisicalProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>InfisicalProvider configures a store to sync secrets using the Infisical provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.InfisicalAuth">
- InfisicalAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Infisical API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretsScope</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.MachineIdentityScopeInWorkspace">
- MachineIdentityScopeInWorkspace
- </a>
- </em>
- </td>
- <td>
- <p>SecretsScope defines the scope of the secrets within the workspace</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>hostAPI</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to “<a href="https://app.infisical.com/api"">https://app.infisical.com/api”</a>.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.KeeperSecurityProvider">KeeperSecurityProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>KeeperSecurityProvider Configures a store to sync secrets using Keeper Security.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>folderID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.KubernetesAuth">KubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.KubernetesProvider">KubernetesProvider</a>)
- </p>
- <p>
- <p>KubernetesAuth defines authentication methods for the Kubernetes provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>cert</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CertAuth">
- CertAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>has both clientCert and clientKey as secretKeySelector</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TokenAuth">
- TokenAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>use static token to authenticate with</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccount</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>points to a service account that should be used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.KubernetesProvider">KubernetesProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>KubernetesProvider configures a store to sync secrets with a Kubernetes instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.KubernetesServer">
- KubernetesServer
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>configures the Kubernetes server Address.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.KubernetesAuth">
- KubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how secret-manager authenticates with a Kubernetes instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>authRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A reference to a secret that contains the auth information.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>remoteNamespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Remote namespace to fetch the secrets from</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.KubernetesServer">KubernetesServer
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.KubernetesProvider">KubernetesProvider</a>)
- </p>
- <p>
- <p>KubernetesServer defines the Kubernetes server connection configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>configures the Kubernetes server Address.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CABundle is a base64-encoded CA certificate</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>see: <a href="https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider">https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.MachineIdentityScopeInWorkspace">MachineIdentityScopeInWorkspace
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.InfisicalProvider">InfisicalProvider</a>)
- </p>
- <p>
- <p>MachineIdentityScopeInWorkspace defines the scope of a machine identity in an Infisical workspace.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretsPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretsPath specifies the path to the secrets within the workspace. Defaults to “/” if not provided.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>recursive</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>EnvironmentSlug is the required slug identifier for the environment.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectSlug is the required slug identifier for the project.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expandSecretReferences</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.NTLMProtocol">NTLMProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AuthorizationProtocol">AuthorizationProtocol</a>)
- </p>
- <p>
- <p>NTLMProtocol contains the NTLM-specific configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>usernameSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>passwordSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.NoSecretError">NoSecretError
- </h3>
- <p>
- <p>NoSecretError shall be returned when a GetSecret can not find the
- desired secret. This is used for deletionPolicy.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.NotModifiedError">NotModifiedError
- </h3>
- <p>
- <p>NotModifiedError to signal that the webhook received no changes,
- and it should just return without doing anything.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.OnboardbaseAuthSecretRef">OnboardbaseAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OnboardbaseProvider">OnboardbaseProvider</a>)
- </p>
- <p>
- <p>OnboardbaseAuthSecretRef holds secret references for onboardbase API Key credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiKeyRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>OnboardbaseAPIKey is the APIKey generated by an admin account.
- It is used to recognize and authorize access to a project and environment within onboardbase</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>passcodeRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>OnboardbasePasscode is the passcode attached to the API Key</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OnboardbaseProvider">OnboardbaseProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OnboardbaseProvider configures a store to sync secrets using the Onboardbase provider.
- Project and Config are required if not using a Service Token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OnboardbaseAuthSecretRef">
- OnboardbaseAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how the Operator authenticates with the Onboardbase API</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>apiHost</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIHost use this to configure the host url for the API for selfhosted installation, default is <a href="https://public.onboardbase.com/api/v1/">https://public.onboardbase.com/api/v1/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Project is an onboardbase project that the secrets should be pulled from</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment is the name of an environmnent within a project to pull the secrets from</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OnePasswordAuth">OnePasswordAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OnePasswordProvider">OnePasswordProvider</a>)
- </p>
- <p>
- <p>OnePasswordAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OnePasswordAuthSecretRef">
- OnePasswordAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OnePasswordAuthSecretRef">OnePasswordAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OnePasswordAuth">OnePasswordAuth</a>)
- </p>
- <p>
- <p>OnePasswordAuthSecretRef holds secret references for 1Password credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>connectTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The ConnectToken is used for authentication to a 1Password Connect Server.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OnePasswordProvider">OnePasswordProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OnePasswordProvider configures a store to sync secrets using the 1Password Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OnePasswordAuth">
- OnePasswordAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against OnePassword Connect Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>connectHost</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ConnectHost defines the OnePassword Connect Server to connect to</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaults</code></br>
- <em>
- map[string]int
- </em>
- </td>
- <td>
- <p>Vaults defines which OnePassword vaults to search in which order</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OracleAuth">OracleAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OracleProvider">OracleProvider</a>)
- </p>
- <p>
- <p>OracleAuth defines authentication configuration for the Oracle Vault provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>tenancy</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Tenancy is the tenancy OCID where user is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>user</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>User is an access OCID specific to the account.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OracleSecretRef">
- OracleSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef to pass through sensitive information.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OraclePrincipalType">OraclePrincipalType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OracleProvider">OracleProvider</a>)
- </p>
- <p>
- <p>OraclePrincipalType defines the type of principal used for authentication to Oracle Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"InstancePrincipal"</p></td>
- <td><p>InstancePrincipal represents a instance principal.</p>
- </td>
- </tr><tr><td><p>"UserPrincipal"</p></td>
- <td><p>UserPrincipal represents a user principal.</p>
- </td>
- </tr><tr><td><p>"Workload"</p></td>
- <td><p>WorkloadPrincipal represents a workload principal.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OracleProvider">OracleProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>OracleProvider configures a store to sync secrets using an Oracle Vault backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region is the region where vault is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault is the vault’s OCID of the specific vault where secret is located.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>compartment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Compartment is the vault compartment OCID.
- Required for PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>encryptionKey</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>EncryptionKey is the OCID of the encryption key within the vault.
- Required for PushSecret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>principalType</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OraclePrincipalType">
- OraclePrincipalType
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The type of principal to use for authentication. If left blank, the Auth struct will
- determine the principal type. This optional field must be specified if using
- workload identity.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OracleAuth">
- OracleAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth configures how secret-manager authenticates with the Oracle Vault.
- If empty, use the instance principal, otherwise the user credentials specified in Auth.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specified the service account
- that should be used when authenticating with WorkloadIdentity.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.OracleSecretRef">OracleSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.OracleAuth">OracleAuth</a>)
- </p>
- <p>
- <p>OracleSecretRef defines references to secrets containing Oracle credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privatekey</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>PrivateKey is the user’s API Signing Key in PEM format, used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fingerprint</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Fingerprint is the fingerprint of the API private key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PassboltAuth">PassboltAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PassboltProvider">PassboltProvider</a>)
- </p>
- <p>
- <p>PassboltAuth contains credentials and configuration for authenticating with the Passbolt server.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>passwordSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>PasswordSecretRef is a reference to the secret containing the Passbolt password</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>privateKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>PrivateKeySecretRef is a reference to the secret containing the Passbolt private key</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PassboltProvider">PassboltProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PassboltProvider defines configuration for the Passbolt provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PassboltAuth">
- PassboltAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Passbolt Server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>host</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Host defines the Passbolt Server to connect to</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PasswordDepotAuth">PasswordDepotAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PasswordDepotProvider">PasswordDepotProvider</a>)
- </p>
- <p>
- <p>PasswordDepotAuth defines the authentication method for the Password Depot provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PasswordDepotSecretRef">
- PasswordDepotSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PasswordDepotProvider">PasswordDepotProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PasswordDepotProvider configures a store to sync secrets with a Password Depot instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>host</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Password Depot instance URL.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>database</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Database to use as source</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PasswordDepotAuth">
- PasswordDepotAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with a Password Depot instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PasswordDepotSecretRef">PasswordDepotSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PasswordDepotAuth">PasswordDepotAuth</a>)
- </p>
- <p>
- <p>PasswordDepotSecretRef defines a reference to a secret containing credentials for the Password Depot provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>credentials</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username / Password is used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PreviderAuth">PreviderAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PreviderProvider">PreviderProvider</a>)
- </p>
- <p>
- <p>PreviderAuth contains a secretRef for credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PreviderAuthSecretRef">
- PreviderAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PreviderAuthSecretRef">PreviderAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PreviderAuth">PreviderAuth</a>)
- </p>
- <p>
- <p>PreviderAuthSecretRef holds secret references for Previder Vault credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessToken is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PreviderProvider">PreviderProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PreviderProvider configures a store to sync secrets using the Previder Secret Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PreviderAuth">
- PreviderAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>baseUri</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.Provider">Provider
- </h3>
- <p>
- <p>Provider is a common interface for interacting with secret backends.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.PulumiProvider">PulumiProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>PulumiProvider defines configuration for the Pulumi provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL is the URL of the Pulumi API.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessToken</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PulumiProviderSecretRef">
- PulumiProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>AccessToken is the access tokens to sign in to the Pulumi Cloud Console.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>organization</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Organization are a space to collaborate on shared projects and stacks.
- To create a new organization, visit <a href="https://app.pulumi.com/">https://app.pulumi.com/</a> and click “New Organization”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>project</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Project is the name of the Pulumi ESC project the environment belongs to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Environment are YAML documents composed of static key-value pairs, programmatic expressions,
- dynamically retrieved values from supported providers including all major clouds,
- and other Pulumi ESC environments.
- To create a new environment, visit <a href="https://www.pulumi.com/docs/esc/environments/">https://www.pulumi.com/docs/esc/environments/</a> for more information.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PulumiProviderSecretRef">PulumiProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.PulumiProvider">PulumiProvider</a>)
- </p>
- <p>
- <p>PulumiProviderSecretRef defines a reference to a secret containing credentials for the Pulumi provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>SecretRef is a reference to a secret containing the Pulumi API token.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.PushSecretData">PushSecretData
- </h3>
- <p>
- <p>PushSecretData is an interface to allow using v1alpha1.PushSecretData content in Provider registered in v1beta1.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.PushSecretRemoteRef">PushSecretRemoteRef
- </h3>
- <p>
- <p>PushSecretRemoteRef is an interface to allow using v1alpha1.PushSecretRemoteRef in Provider registered in v1beta1.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.ScalewayProvider">ScalewayProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>ScalewayProvider defines configuration for the Scaleway provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>APIURL is the url of the api to use. Defaults to <a href="https://api.scaleway.com">https://api.scaleway.com</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region where your secrets are located: <a href="https://developers.scaleway.com/en/quickstart/#region-and-zone">https://developers.scaleway.com/en/quickstart/#region-and-zone</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID is the id of your project, which you can find in the console: <a href="https://console.scaleway.com/project/settings">https://console.scaleway.com/project/settings</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>accessKey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ScalewayProviderSecretRef">
- ScalewayProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>AccessKey is the non-secret part of the api key.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretKey</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ScalewayProviderSecretRef">
- ScalewayProviderSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>SecretKey is the non-secret part of the api key.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ScalewayProviderSecretRef">ScalewayProviderSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ScalewayProvider">ScalewayProvider</a>)
- </p>
- <p>
- <p>ScalewayProviderSecretRef defines a reference to a secret containing credentials for the Scaleway provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretServerProvider">SecretServerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>SecretServerProvider defines configuration for the Delinea Secret Server provider.
- See <a href="https://github.com/DelineaXPM/tss-sdk-go/blob/main/server/server.go">https://github.com/DelineaXPM/tss-sdk-go/blob/main/server/server.go</a>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretServerProviderRef">
- SecretServerProviderRef
- </a>
- </em>
- </td>
- <td>
- <p>Username is the secret server account username.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>password</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretServerProviderRef">
- SecretServerProviderRef
- </a>
- </em>
- </td>
- <td>
- <p>Password is the secret server account password.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serverURL</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServerURL
- URL to your secret server installation</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretServerProviderRef">SecretServerProviderRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretServerProvider">SecretServerProvider</a>)
- </p>
- <p>
- <p>SecretServerProviderRef defines a reference to a secret containing credentials for the Secret Server provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Value can be specified directly to set a value without using a secret.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef references a key in a secret that will be used as value.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStore">SecretStore
- </h3>
- <p>
- <p>SecretStore represents a secure external location for storing secrets, which can be referenced as part of <code>storeRef</code> fields.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreSpec">
- SecretStoreSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatus">
- SecretStoreStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreCapabilities">SecretStoreCapabilities
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatus">SecretStoreStatus</a>)
- </p>
- <p>
- <p>SecretStoreCapabilities defines the possible operations a SecretStore can do.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ReadOnly"</p></td>
- <td><p>SecretStoreReadOnly indicates that the SecretStore only supports reading secrets.</p>
- </td>
- </tr><tr><td><p>"ReadWrite"</p></td>
- <td><p>SecretStoreReadWrite indicates that the SecretStore supports both reading and writing secrets.</p>
- </td>
- </tr><tr><td><p>"WriteOnly"</p></td>
- <td><p>SecretStoreWriteOnly indicates that the SecretStore only supports writing secrets.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreConditionType">SecretStoreConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatusCondition">SecretStoreStatusCondition</a>)
- </p>
- <p>
- <p>SecretStoreConditionType represents the condition type of the SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>SecretStoreReady indicates that the SecretStore has been successfully configured.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreSpec">SecretStoreSpec</a>)
- </p>
- <p>
- <p>SecretStoreProvider contains the provider-specific configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>aws</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AWSProvider">
- AWSProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS configures this store to sync secrets using AWS Secret Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>azurekv</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AzureKVProvider">
- AzureKVProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AzureKV configures this store to sync secrets using Azure Key Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>akeyless</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AkeylessProvider">
- AkeylessProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Akeyless configures this store to sync secrets using Akeyless Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>bitwardensecretsmanager</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BitwardenSecretsManagerProvider">
- BitwardenSecretsManagerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vault</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultProvider">
- VaultProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Vault configures this store to sync secrets using the HashiCorp Vault provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcpsm</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GCPSMProvider">
- GCPSMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>oracle</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OracleProvider">
- OracleProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Oracle configures this store to sync secrets using Oracle Vault provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ibm</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.IBMProvider">
- IBMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>IBM configures this store to sync secrets using IBM Cloud provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>yandexcertificatemanager</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexCertificateManagerProvider">
- YandexCertificateManagerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>yandexlockbox</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexLockboxProvider">
- YandexLockboxProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>YandexLockbox configures this store to sync secrets using Yandex Lockbox provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>github</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GithubProvider">
- GithubProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Github configures this store to push GitHub Actions secrets using the GitHub API provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>gitlab</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GitlabProvider">
- GitlabProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GitLab configures this store to sync secrets using GitLab Variables provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>alibaba</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AlibabaProvider">
- AlibabaProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Alibaba configures this store to sync secrets using Alibaba Cloud provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>onepassword</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OnePasswordProvider">
- OnePasswordProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>OnePassword configures this store to sync secrets using the 1Password Cloud provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>webhook</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.WebhookProvider">
- WebhookProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Webhook configures this store to sync secrets using a generic templated webhook</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetes</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.KubernetesProvider">
- KubernetesProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes configures this store to sync secrets using a Kubernetes cluster provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fake</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.FakeProvider">
- FakeProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Fake configures a store with static key/value pairs</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>senhasegura</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SenhaseguraProvider">
- SenhaseguraProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Senhasegura configures this store to sync secrets using senhasegura provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scaleway</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ScalewayProvider">
- ScalewayProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Scaleway configures this store to sync secrets using the Scaleway provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>doppler</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DopplerProvider">
- DopplerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Doppler configures this store to sync secrets using the Doppler provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>previder</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PreviderProvider">
- PreviderProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Previder configures this store to sync secrets using the Previder provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>onboardbase</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.OnboardbaseProvider">
- OnboardbaseProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Onboardbase configures this store to sync secrets using the Onboardbase provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keepersecurity</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.KeeperSecurityProvider">
- KeeperSecurityProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conjur</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ConjurProvider">
- ConjurProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Conjur configures this store to sync secrets using conjur provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>delinea</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.DelineaProvider">
- DelineaProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Delinea DevOps Secrets Vault
- <a href="https://docs.delinea.com/online-help/products/devops-secrets-vault/current">https://docs.delinea.com/online-help/products/devops-secrets-vault/current</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretserver</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretServerProvider">
- SecretServerProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretServer configures this store to sync secrets using SecretServer provider
- <a href="https://docs.delinea.com/online-help/secret-server/start.htm">https://docs.delinea.com/online-help/secret-server/start.htm</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>chef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ChefProvider">
- ChefProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Chef configures this store to sync secrets with chef server</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>pulumi</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PulumiProvider">
- PulumiProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Pulumi configures this store to sync secrets using the Pulumi provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>fortanix</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.FortanixProvider">
- FortanixProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Fortanix configures this store to sync secrets using the Fortanix provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>passworddepot</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PasswordDepotProvider">
- PasswordDepotProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>passbolt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.PassboltProvider">
- PassboltProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>device42</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.Device42Provider">
- Device42Provider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Device42 configures this store to sync secrets using the Device42 provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>infisical</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.InfisicalProvider">
- InfisicalProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Infisical configures this store to sync secrets using the Infisical provider</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>beyondtrust</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.BeyondtrustProvider">
- BeyondtrustProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Beyondtrust configures this store to sync secrets using Password Safe provider.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cloudrusm</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CloudruSMProvider">
- CloudruSMProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreRef">SecretStoreRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretSpec">ExternalSecretSpec</a>,
- <a href="#external-secrets.io/v1beta1.StoreGeneratorSourceRef">StoreGeneratorSourceRef</a>,
- <a href="#external-secrets.io/v1beta1.StoreSourceRef">StoreSourceRef</a>)
- </p>
- <p>
- <p>SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the SecretStore resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
- Defaults to <code>SecretStore</code></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreRetrySettings">SecretStoreRetrySettings
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreSpec">SecretStoreSpec</a>)
- </p>
- <p>
- <p>SecretStoreRetrySettings defines configuration for retrying failed requests to the provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>maxRetries</code></br>
- <em>
- int32
- </em>
- </td>
- <td>
- <p>MaxRetries is the maximum number of retry attempts.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retryInterval</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>RetryInterval is the interval between retry attempts.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreSpec">SecretStoreSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterSecretStore">ClusterSecretStore</a>,
- <a href="#external-secrets.io/v1beta1.SecretStore">SecretStore</a>)
- </p>
- <p>
- <p>SecretStoreSpec defines the desired state of SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters ES based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">
- SecretStoreProvider
- </a>
- </em>
- </td>
- <td>
- <p>Used to configure the provider. Only one provider may be set</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure HTTP retries on failures.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>refreshInterval</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.ClusterSecretStoreCondition">
- []ClusterSecretStoreCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreStatus">SecretStoreStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ClusterSecretStore">ClusterSecretStore</a>,
- <a href="#external-secrets.io/v1beta1.SecretStore">SecretStore</a>)
- </p>
- <p>
- <p>SecretStoreStatus defines the observed state of the SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatusCondition">
- []SecretStoreStatusCondition
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>capabilities</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreCapabilities">
- SecretStoreCapabilities
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretStoreStatusCondition">SecretStoreStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreStatus">SecretStoreStatus</a>)
- </p>
- <p>
- <p>SecretStoreStatusCondition defines the observed condition of the SecretStore.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreConditionType">
- SecretStoreConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SecretsClient">SecretsClient
- </h3>
- <p>
- <p>SecretsClient provides access to secrets.</p>
- </p>
- <h3 id="external-secrets.io/v1beta1.SecretsManager">SecretsManager
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.AWSProvider">AWSProvider</a>)
- </p>
- <p>
- <p>SecretsManager defines how the provider behaves when interacting with AWS
- SecretsManager. Some of these settings are only applicable to controlling how
- secrets are deleted, and hence only apply to PushSecret (and only when
- deletionPolicy is set to Delete).</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>forceDeleteWithoutRecovery</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specifies whether to delete the secret without any recovery window. You
- can’t use both this parameter and RecoveryWindowInDays in the same call.
- If you don’t use either, then by default Secrets Manager uses a 30 day
- recovery window.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery">https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>recoveryWindowInDays</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The number of days from 7 to 30 that Secrets Manager waits before
- permanently deleting the secret. You can’t use both this parameter and
- ForceDeleteWithoutRecovery in the same call. If you don’t use either,
- then by default Secrets Manager uses a 30 day recovery window.
- see: <a href="https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays">https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SenhaseguraAuth">SenhaseguraAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SenhaseguraProvider">SenhaseguraProvider</a>)
- </p>
- <p>
- <p>SenhaseguraAuth tells the controller how to do auth in senhasegura.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecretSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SenhaseguraModuleType">SenhaseguraModuleType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SenhaseguraProvider">SenhaseguraProvider</a>)
- </p>
- <p>
- <p>SenhaseguraModuleType enum defines senhasegura target module to fetch secrets</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"DSM"</p></td>
- <td><pre><code> SenhaseguraModuleDSM is the senhasegura DevOps Secrets Management module
- see: https://senhasegura.com/devops
- </code></pre>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.SenhaseguraProvider">SenhaseguraProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>SenhaseguraProvider setup a store to sync secrets with senhasegura.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL of senhasegura</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>module</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SenhaseguraModuleType">
- SenhaseguraModuleType
- </a>
- </em>
- </td>
- <td>
- <p>Module defines which senhasegura module should be used to get secrets</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SenhaseguraAuth">
- SenhaseguraAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines parameters to authenticate in senhasegura</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ignoreSslCertificate</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>IgnoreSslCertificate defines if SSL certificate must be ignored</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.StoreGeneratorSourceRef">StoreGeneratorSourceRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretDataFromRemoteRef">ExternalSecretDataFromRemoteRef</a>)
- </p>
- <p>
- <p>StoreGeneratorSourceRef allows you to override the source
- from which the secret will be pulled from.
- You can define at maximum one property.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>storeRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>generatorRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GeneratorRef">
- GeneratorRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GeneratorRef points to a generator custom resource.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.StoreSourceRef">StoreSourceRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretData">ExternalSecretData</a>)
- </p>
- <p>
- <p>StoreSourceRef allows you to override the SecretStore source
- from which the secret will be pulled from.
- You can define at maximum one property.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>storeRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.SecretStoreRef">
- SecretStoreRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>generatorRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.GeneratorRef">
- GeneratorRef
- </a>
- </em>
- </td>
- <td>
- <p>GeneratorRef points to a generator custom resource.</p>
- <p>Deprecated: The generatorRef is not implemented in .data[].
- this will be removed with v1.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.Tag">Tag
- </h3>
- <p>
- <p>Tag defines a tag key and value for AWS resources.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>value</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateEngineVersion">TemplateEngineVersion
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateEngineVersion defines the version of the template engine to use.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"v2"</p></td>
- <td><p>TemplateEngineV2 specifies the v2 template engine version.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateFrom">TemplateFrom
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateFrom defines a source for template data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>configMap</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateRef">
- TemplateRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>secret</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateRef">
- TemplateRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>target</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateTarget">
- TemplateTarget
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>literal</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateMergePolicy">TemplateMergePolicy
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.ExternalSecretTemplate">ExternalSecretTemplate</a>)
- </p>
- <p>
- <p>TemplateMergePolicy defines how template values should be merged when generating a secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Merge"</p></td>
- <td><p>MergePolicyMerge merges the template content with existing values.</p>
- </td>
- </tr><tr><td><p>"Replace"</p></td>
- <td><p>MergePolicyReplace replaces the entire template content during merge operations.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateRef">TemplateRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.TemplateFrom">TemplateFrom</a>)
- </p>
- <p>
- <p>TemplateRef defines a reference to a template source in a ConfigMap or Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the ConfigMap/Secret resource</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>items</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateRefItem">
- []TemplateRefItem
- </a>
- </em>
- </td>
- <td>
- <p>A list of keys in the ConfigMap/Secret to use as templates for Secret data</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateRefItem">TemplateRefItem
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.TemplateRef">TemplateRef</a>)
- </p>
- <p>
- <p>TemplateRefItem defines which key in the referenced ConfigMap or Secret to use as a template.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A key in the ConfigMap/Secret</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>templateAs</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.TemplateScope">
- TemplateScope
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateScope">TemplateScope
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.TemplateRefItem">TemplateRefItem</a>)
- </p>
- <p>
- <p>TemplateScope defines the scope of the template when processing template data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"KeysAndValues"</p></td>
- <td><p>TemplateScopeKeysAndValues processes both keys and values of the data.</p>
- </td>
- </tr><tr><td><p>"Values"</p></td>
- <td><p>TemplateScopeValues processes only the values of the data.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TemplateTarget">TemplateTarget
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.TemplateFrom">TemplateFrom</a>)
- </p>
- <p>
- <p>TemplateTarget defines the target field where the template result will be stored.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Annotations"</p></td>
- <td><p>TemplateTargetAnnotations stores template results in the annotations field of the secret.</p>
- </td>
- </tr><tr><td><p>"Data"</p></td>
- <td><p>TemplateTargetData stores template results in the data field of the secret.</p>
- </td>
- </tr><tr><td><p>"Labels"</p></td>
- <td><p>TemplateTargetLabels stores template results in the labels field of the secret.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.TokenAuth">TokenAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.KubernetesAuth">KubernetesAuth</a>)
- </p>
- <p>
- <p>TokenAuth defines token-based authentication for the Kubernetes provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>bearerToken</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.UniversalAuthCredentials">UniversalAuthCredentials
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.InfisicalAuth">InfisicalAuth</a>)
- </p>
- <p>
- <p>UniversalAuthCredentials defines the credentials for Infisical Universal Auth.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.ValidationResult">ValidationResult
- (<code>byte</code> alias)</p></h3>
- <p>
- <p>ValidationResult represents the result of validating a provider client configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>2</p></td>
- <td><p>ValidationResultError indicates that there is a misconfiguration.</p>
- </td>
- </tr><tr><td><p>0</p></td>
- <td><p>ValidationResultReady indicates that the client is configured correctly and can be used.</p>
- </td>
- </tr><tr><td><p>1</p></td>
- <td><p>ValidationResultUnknown indicates that the client can be used but information is missing and it can not be validated.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultAppRole">VaultAppRole
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultAppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the App Role authentication backend is mounted
- in Vault, e.g: “approle”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RoleID configured in the App Role authentication backend when setting
- up the authentication backend in Vault.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>roleRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Reference to a key in a Secret that contains the App Role ID used
- to authenticate with Vault.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role id.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Reference to a key in a Secret that contains the App Role secret used
- to authenticate with Vault.
- The <code>key</code> field must be specified and denotes which entry within the Secret
- resource is used as the app role secret.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultAuth">VaultAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultAuth is the configuration used to authenticate with a Vault server.
- Only one of <code>tokenSecretRef</code>, <code>appRole</code>, <code>kubernetes</code>, <code>ldap</code>, <code>userPass</code>, <code>jwt</code> or <code>cert</code>
- can be specified. A namespace to authenticate against can optionally be specified.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
- Namespaces is a set of features within Vault Enterprise that allows
- Vault environments to support Secure Multi-tenancy. e.g: “ns1”.
- More about namespaces can be found here <a href="https://www.vaultproject.io/docs/enterprise/namespaces">https://www.vaultproject.io/docs/enterprise/namespaces</a>
- This will default to Vault.Namespace field if set, or empty otherwise</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TokenSecretRef authenticates with Vault by presenting a token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appRole</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAppRole">
- VaultAppRole
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AppRole authenticates with Vault using the App Role auth mechanism,
- with the role and secret stored in a Kubernetes Secret resource.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetes</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultKubernetesAuth">
- VaultKubernetesAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Kubernetes authenticates with Vault by passing the ServiceAccount
- token stored in the named Secret resource to the Vault server.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>ldap</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultLdapAuth">
- VaultLdapAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Ldap authenticates with Vault by passing username/password pair using
- the LDAP authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultJwtAuth">
- VaultJwtAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Jwt authenticates with Vault by passing role and JWT token using the
- JWT/OIDC authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>cert</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultCertAuth">
- VaultCertAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
- Cert authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>iam</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultIamAuth">
- VaultIamAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
- AWS IAM authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>userPass</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultUserPassAuth">
- VaultUserPassAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>UserPass authenticates with Vault by passing username/password pair</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultAwsAuth">VaultAwsAuth
- </h3>
- <p>
- <p>VaultAwsAuth tells the controller how to do authentication with aws.
- Only one of secretRef or jwt can be specified.
- if none is specified the controller will try to load credentials from its own service account assuming it is IRSA enabled.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAwsAuthSecretRef">
- VaultAwsAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAwsJWTAuth">
- VaultAwsJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultAwsAuthSecretRef">VaultAwsAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAwsAuth">VaultAwsAuth</a>,
- <a href="#external-secrets.io/v1beta1.VaultIamAuth">VaultIamAuth</a>)
- </p>
- <p>
- <p>VaultAwsAuthSecretRef holds secret references for AWS credentials
- both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SessionToken used for authentication
- This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
- see: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultAwsJWTAuth">VaultAwsJWTAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAwsAuth">VaultAwsAuth</a>,
- <a href="#external-secrets.io/v1beta1.VaultIamAuth">VaultIamAuth</a>)
- </p>
- <p>
- <p>VaultAwsJWTAuth Authenticate against AWS using service account tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultCertAuth">VaultCertAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultCertAuth authenticates with Vault using the JWT/OIDC authentication
- method, with the role name and token stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientCert</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ClientCert is a certificate to authenticate using the Cert Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing client private key to
- authenticate with Vault using the Cert authentication method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultClientTLS">VaultClientTLS
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultClientTLS is the configuration used for client side related TLS communication,
- when the Vault server requires mutual authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>CertSecretRef is a certificate added to the transport layer
- when communicating with the Vault server.
- If no key for the Secret is specified, external-secret will default to ‘tls.crt’.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>KeySecretRef to a key in a Secret resource containing client private key
- added to the transport layer when communicating with the Vault server.
- If no key for the Secret is specified, external-secret will default to ‘tls.key’.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultIamAuth">VaultIamAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultIamAuth authenticates with Vault using the Vault’s AWS IAM authentication method. Refer: <a href="https://developer.hashicorp.com/vault/docs/auth/aws">https://developer.hashicorp.com/vault/docs/auth/aws</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path where the AWS auth method is enabled in Vault, e.g: “aws”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>AWS region</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>This is the AWS role to be assumed before talking to vault</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultRole</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>externalID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>AWS External ID set on assumed IAM roles</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultAwsIamServerID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: <a href="https://developer.hashicorp.com/vault/docs/auth/aws">https://developer.hashicorp.com/vault/docs/auth/aws</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAwsAuthSecretRef">
- VaultAwsAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify credentials in a Secret object</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAwsJWTAuth">
- VaultAwsJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Specify a service account with IRSA enabled</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultJwtAuth">VaultJwtAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication
- method, with the role name and a token stored in a Kubernetes Secret resource or
- a Kubernetes service account token retrieved via <code>TokenRequest</code>.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the JWT authentication backend is mounted
- in Vault, e.g: “jwt”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Role is a JWT role to authenticate using the JWT/OIDC Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional SecretRef that refers to a key in a Secret resource containing JWT token to
- authenticate with Vault using the JWT/OIDC authentication method.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>kubernetesServiceAccountToken</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultKubernetesServiceAccountTokenAuth">
- VaultKubernetesServiceAccountTokenAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional ServiceAccountToken specifies the Kubernetes service account for which to request
- a token for with the <code>TokenRequest</code> API.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultKVStoreVersion">VaultKVStoreVersion
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultProvider">VaultProvider</a>)
- </p>
- <p>
- <p>VaultKVStoreVersion defines the version of the KV store in Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"v1"</p></td>
- <td><p>VaultKVStoreV1 represents version 1 of the Vault KV store.</p>
- </td>
- </tr><tr><td><p>"v2"</p></td>
- <td><p>VaultKVStoreV2 represents version 2 of the Vault KV store.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultKubernetesAuth">VaultKubernetesAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultKubernetesAuth authenticates against Vault using a Kubernetes ServiceAccount token stored in a Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>mountPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the Kubernetes authentication backend is mounted in Vault, e.g:
- “kubernetes”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional service account field containing the name of a kubernetes ServiceAccount.
- If the service account is specified, the service account secret token JWT will be used
- for authenticating with Vault. If the service account selector is not supplied,
- the secretRef will be used instead.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional secret field containing a Kubernetes ServiceAccount JWT used
- for authenticating with Vault. If a name is specified without a key,
- <code>token</code> is the default. If one is not specified, the one bound to
- the controller will be used.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A required field containing the Vault Role to assume. A Role binds a
- Kubernetes ServiceAccount with a set of Vault policies.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultKubernetesServiceAccountTokenAuth">VaultKubernetesServiceAccountTokenAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultJwtAuth">VaultJwtAuth</a>)
- </p>
- <p>
- <p>VaultKubernetesServiceAccountTokenAuth authenticates with Vault using a temporary
- Kubernetes service account token retrieved by the <code>TokenRequest</code> API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Service account field containing the name of a kubernetes ServiceAccount.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>audiences</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional audiences field that will be used to request a temporary Kubernetes service
- account token for the service account referenced by <code>serviceAccountRef</code>.
- Defaults to a single audience <code>vault</code> it not specified.</p>
- <p>Deprecated: use serviceAccountRef.Audiences instead</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expirationSeconds</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Optional expiration time in seconds that will be used to request a temporary
- Kubernetes service account token for the service account referenced by
- <code>serviceAccountRef</code>.</p>
- <p>Deprecated: this will be removed in the future.
- Defaults to 10 minutes.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultLdapAuth">VaultLdapAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultLdapAuth authenticates with Vault using the LDAP authentication method,
- with the username and password stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the LDAP authentication backend is mounted
- in Vault, e.g: “ldap”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Username is an LDAP username used to authenticate using the LDAP Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing password for the LDAP
- user used to authenticate with Vault using the LDAP authentication
- method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultProvider">VaultProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>VaultProvider configures a store to sync secrets using a HashiCorp Vault KV backend.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">
- VaultAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how secret-manager authenticates with the Vault server.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>server</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Server is the connection address for the Vault server, e.g: “<a href="https://vault.example.com:8200"">https://vault.example.com:8200”</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Path is the mount path of the Vault KV backend endpoint, e.g:
- “secret”. The v2 KV secret engine version specific “/data” path suffix
- for fetching secrets from Vault is optional and will be appended
- if not present in specified path.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>version</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultKVStoreVersion">
- VaultKVStoreVersion
- </a>
- </em>
- </td>
- <td>
- <p>Version is the Vault KV secret engine version. This can be either “v1” or
- “v2”. Version defaults to “v2”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
- Vault environments to support Secure Multi-tenancy. e.g: “ns1”.
- More about namespaces can be found here <a href="https://www.vaultproject.io/docs/enterprise/namespaces">https://www.vaultproject.io/docs/enterprise/namespaces</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate Vault server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tls</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.VaultClientTLS">
- VaultClientTLS
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The configuration used for client side related TLS communication, when the Vault server
- requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
- This parameter is ignored for plain HTTP protocol connection.
- It’s worth noting this configuration is different from the “TLS certificates auth method”,
- which is available under the <code>auth.cert</code> section.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.CAProvider">
- CAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Vault server certificate.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>readYourWrites</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ReadYourWrites ensures isolated read-after-write semantics by
- providing discovered cluster replication states in each request.
- More information about eventual consistency in Vault can be found here
- <a href="https://www.vaultproject.io/docs/enterprise/consistency">https://www.vaultproject.io/docs/enterprise/consistency</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>forwardInconsistent</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
- leader instead of simply retrying within a loop. This can increase performance if
- the option is enabled serverside.
- <a href="https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header">https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers to be added in Vault request</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.VaultUserPassAuth">VaultUserPassAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.VaultAuth">VaultAuth</a>)
- </p>
- <p>
- <p>VaultUserPassAuth authenticates with Vault using UserPass authentication method,
- with the username and password stored in a Kubernetes Secret resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Path where the UserPassword authentication backend is mounted
- in Vault, e.g: “userpass”</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Username is a username used to authenticate using the UserPass Vault
- authentication method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretRef to a key in a Secret resource containing password for the
- user used to authenticate with Vault using the UserPass authentication
- method</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.WebhookCAProvider">WebhookCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookCAProvider defines a location to fetch the certificate for the webhook provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.WebhookCAProviderType">
- WebhookCAProviderType
- </a>
- </em>
- </td>
- <td>
- <p>The type of provider to use such as “Secret”, or “ConfigMap”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the object located at the provider type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the CA certificate can be found in the Secret or ConfigMap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The namespace the Provider type is in.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.WebhookCAProviderType">WebhookCAProviderType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.WebhookCAProvider">WebhookCAProvider</a>)
- </p>
- <p>
- <p>WebhookCAProviderType defines the type of provider to use for CA certificates with Webhook providers.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ConfigMap"</p></td>
- <td><p>WebhookCAProviderTypeConfigMap indicates that the CA certificate is stored in a ConfigMap.</p>
- </td>
- </tr><tr><td><p>"Secret"</p></td>
- <td><p>WebhookCAProviderTypeSecret indicates that the CA certificate is stored in a Secret.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.WebhookProvider">WebhookProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>WebhookProvider configures a store to sync secrets from simple web APIs.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook Method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook url to call</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.AuthorizationProtocol">
- AuthorizationProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth specifies a authorization protocol. Only one protocol may be set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>body</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Body</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timeout</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Timeout</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>result</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.WebhookResult">
- WebhookResult
- </a>
- </em>
- </td>
- <td>
- <p>Result formatting</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secrets</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.WebhookSecret">
- []WebhookSecret
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secrets to fill in templates
- These secrets will be passed to the templating function as key value pairs under the given name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate webhook server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.WebhookCAProvider">
- WebhookCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate webhook server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.WebhookResult">WebhookResult
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookResult defines how to extract and format the result from the webhook response.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>jsonPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Json path of return value</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.WebhookSecret">WebhookSecret
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.WebhookProvider">WebhookProvider</a>)
- </p>
- <p>
- <p>WebhookSecret defines a secret to be used in webhook templates.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of this secret in templates</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Secret ref to fill in credentials</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexCertificateManagerAuth">YandexCertificateManagerAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.YandexCertificateManagerProvider">YandexCertificateManagerProvider</a>)
- </p>
- <p>
- <p>YandexCertificateManagerAuth defines authentication configuration for the Yandex Certificate Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authorizedKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The authorized key used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexCertificateManagerCAProvider">YandexCertificateManagerCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.YandexCertificateManagerProvider">YandexCertificateManagerProvider</a>)
- </p>
- <p>
- <p>YandexCertificateManagerCAProvider defines CA certificate configuration for Yandex Certificate Manager.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexCertificateManagerProvider">YandexCertificateManagerProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>YandexCertificateManagerProvider configures a store to sync secrets using the Yandex Certificate Manager provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexCertificateManagerAuth">
- YandexCertificateManagerAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Yandex Certificate Manager</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexCertificateManagerCAProvider">
- YandexCertificateManagerCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Yandex.Cloud server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexLockboxAuth">YandexLockboxAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.YandexLockboxProvider">YandexLockboxProvider</a>)
- </p>
- <p>
- <p>YandexLockboxAuth defines authentication configuration for the Yandex Lockbox provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>authorizedKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The authorized key used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexLockboxCAProvider">YandexLockboxCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.YandexLockboxProvider">YandexLockboxProvider</a>)
- </p>
- <p>
- <p>YandexLockboxCAProvider defines CA certificate configuration for Yandex Lockbox.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>certSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="external-secrets.io/v1beta1.YandexLockboxProvider">YandexLockboxProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#external-secrets.io/v1beta1.SecretStoreProvider">SecretStoreProvider</a>)
- </p>
- <p>
- <p>YandexLockboxProvider configures a store to sync secrets using the Yandex Lockbox provider.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiEndpoint</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexLockboxAuth">
- YandexLockboxAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the information necessary to authenticate against Yandex Lockbox</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#external-secrets.io/v1beta1.YandexLockboxCAProvider">
- YandexLockboxCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate Yandex.Cloud server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <hr/>
- <h2 id="generators.external-secrets.io/v1alpha1">generators.external-secrets.io/v1alpha1</h2>
- <p>
- <p>Package v1alpha1 contains resources for generators</p>
- </p>
- <p>Resource Types:</p>
- <ul></ul>
- <h3 id="generators.external-secrets.io/v1alpha1.ACRAccessToken">ACRAccessToken
- </h3>
- <p>
- <p>ACRAccessToken returns an Azure Container Registry token
- that can be used for pushing/pulling images.
- Note: by default it will return an ACR Refresh Token with full access
- (depending on the identity).
- This can be scoped down to the repository level using .spec.scope.
- In case scope is defined it will return an ACR Access Token.</p>
- <p>See docs: <a href="https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md">https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAccessTokenSpec">
- ACRAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAuth">
- ACRAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>registry</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the domain name of the ACR registry
- e.g. foobarexample.azurecr.io</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scope</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Define the scope for the access token, e.g. pull/push access for a repository.
- if not provided it will return a refresh token that has full scope.
- Note: you need to pin it down to the repository level, there is no wildcard available.</p>
- <p>examples:
- repository:my-repository:pull,push
- repository:my-repository:pull</p>
- <p>see docs for details: <a href="https://docs.docker.com/registry/spec/auth/scope/">https://docs.docker.com/registry/spec/auth/scope/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentType</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureEnvironmentType">
- AzureEnvironmentType
- </a>
- </em>
- </td>
- <td>
- <p>EnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default, it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ACRAccessTokenSpec">ACRAccessTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAccessToken">ACRAccessToken</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>ACRAccessTokenSpec defines how to generate the access token
- e.g. how to authenticate and which registry to use.
- see: <a href="https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview">https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAuth">
- ACRAuth
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>tenantId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>registry</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>the domain name of the ACR registry
- e.g. foobarexample.azurecr.io</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scope</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Define the scope for the access token, e.g. pull/push access for a repository.
- if not provided it will return a refresh token that has full scope.
- Note: you need to pin it down to the repository level, there is no wildcard available.</p>
- <p>examples:
- repository:my-repository:pull,push
- repository:my-repository:pull</p>
- <p>see docs for details: <a href="https://docs.docker.com/registry/spec/auth/scope/">https://docs.docker.com/registry/spec/auth/scope/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>environmentType</code></br>
- <em>
- <a href="#external-secrets.io/v1.AzureEnvironmentType">
- AzureEnvironmentType
- </a>
- </em>
- </td>
- <td>
- <p>EnvironmentType specifies the Azure cloud environment endpoints to use for
- connecting and authenticating with Azure. By default, it points to the public cloud AAD endpoint.
- The following endpoints are available, also see here: <a href="https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152">https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152</a>
- PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ACRAuth">ACRAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAccessTokenSpec">ACRAccessTokenSpec</a>)
- </p>
- <p>
- <p>ACRAuth defines the authentication methods for Azure Container Registry.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>servicePrincipal</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AzureACRServicePrincipalAuth">
- AzureACRServicePrincipalAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServicePrincipal uses Azure Service Principal credentials to authenticate with Azure.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>managedIdentity</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AzureACRManagedIdentityAuth">
- AzureACRManagedIdentityAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ManagedIdentity uses Azure Managed Identity to authenticate with Azure.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AzureACRWorkloadIdentityAuth">
- AzureACRWorkloadIdentityAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AWSAuth">AWSAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ECRAuthorizationTokenSpec">ECRAuthorizationTokenSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.STSSessionTokenSpec">STSSessionTokenSpec</a>)
- </p>
- <p>
- <p>AWSAuth tells the controller how to do authentication with aws.
- Only one of secretRef or jwt can be specified.
- if none is specified the controller will load credentials using the aws sdk defaults.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuthSecretRef">
- AWSAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>jwt</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSJWTAuth">
- AWSJWTAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AWSAuthSecretRef">AWSAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSAuthSecretRef holds secret references for AWS credentials
- both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>accessKeyIDSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The AccessKeyID is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>sessionTokenSecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The SessionToken used for authentication
- This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
- see: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AWSJWTAuth">AWSJWTAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">AWSAuth</a>)
- </p>
- <p>
- <p>AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AuthorizationProtocol">AuthorizationProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">WebhookSpec</a>)
- </p>
- <p>
- <p>AuthorizationProtocol contains the protocol-specific configuration</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>ntlm</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.NTLMProtocol">
- NTLMProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>NTLMProtocol configures the store to use NTLM for auth</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AzureACRManagedIdentityAuth">AzureACRManagedIdentityAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAuth">ACRAuth</a>)
- </p>
- <p>
- <p>AzureACRManagedIdentityAuth defines the configuration for using Azure Managed Identity authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>identityId</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>If multiple Managed Identity is assigned to the pod, you can select the one to be used</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AzureACRServicePrincipalAuth">AzureACRServicePrincipalAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAuth">ACRAuth</a>)
- </p>
- <p>
- <p>AzureACRServicePrincipalAuth defines the configuration for using Azure Service Principal authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AzureACRServicePrincipalAuthSecretRef">
- AzureACRServicePrincipalAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AzureACRServicePrincipalAuthSecretRef">AzureACRServicePrincipalAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.AzureACRServicePrincipalAuth">AzureACRServicePrincipalAuth</a>)
- </p>
- <p>
- <p>AzureACRServicePrincipalAuthSecretRef defines the secret references for Azure Service Principal authentication.
- It uses static credentials stored in a Kind=Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>clientId</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The Azure clientId of the service principle used for authentication.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>clientSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>The Azure ClientSecret of the service principle used for authentication.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.AzureACRWorkloadIdentityAuth">AzureACRWorkloadIdentityAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAuth">ACRAuth</a>)
- </p>
- <p>
- <p>AzureACRWorkloadIdentityAuth defines the configuration for using Azure Workload Identity authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ServiceAccountRef specified the service account
- that should be used when authenticating with WorkloadIdentity.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecret">BeyondtrustWorkloadCredentialsDynamicSecret
- </h3>
- <p>
- <p>BeyondtrustWorkloadCredentialsDynamicSecret represents a generator that requests dynamic credentials from BeyondTrust Workload Credentials.
- This generator calls the BeyondTrust Workload Credentials API to generate fresh, temporary credentials
- (such as AWS STS credentials) each time an ExternalSecret is refreshed.
- Dynamic secret definitions must be created in BeyondTrust Workload Credentials before they can be referenced.
- For complete documentation, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecretSpec">
- BeyondtrustWorkloadCredentialsDynamicSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Controller selects the controller that should handle this generator.
- Leave empty to use the default controller.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">
- BeyondtrustWorkloadCredentialsProvider
- </a>
- </em>
- </td>
- <td>
- <p>Provider contains the BeyondtrustWorkloadCredentials provider configuration including authentication,
- server connection details, and the folder path to the dynamic secret definition.
- The folderPath should point to a dynamic secret definition that has been created in
- BeyondTrust Workload Credentials (e.g., “production/aws-temp”).
- For setup details, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RetrySettings configures exponential backoff for failed API requests.
- If not specified, uses the default retry settings.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecretSpec">BeyondtrustWorkloadCredentialsDynamicSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecret">BeyondtrustWorkloadCredentialsDynamicSecret</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>BeyondtrustWorkloadCredentialsDynamicSecretSpec defines the desired spec for BeyondtrustWorkloadCredentials dynamic generator.
- This generator enables obtaining temporary, short-lived credentials from BeyondTrust Workload Credentials.
- For more information, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Controller selects the controller that should handle this generator.
- Leave empty to use the default controller.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.BeyondtrustWorkloadCredentialsProvider">
- BeyondtrustWorkloadCredentialsProvider
- </a>
- </em>
- </td>
- <td>
- <p>Provider contains the BeyondtrustWorkloadCredentials provider configuration including authentication,
- server connection details, and the folder path to the dynamic secret definition.
- The folderPath should point to a dynamic secret definition that has been created in
- BeyondTrust Workload Credentials (e.g., “production/aws-temp”).
- For setup details, see: <a href="https://docs.beyondtrust.com/bt-docs/docs/secrets-api">https://docs.beyondtrust.com/bt-docs/docs/secrets-api</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RetrySettings configures exponential backoff for failed API requests.
- If not specified, uses the default retry settings.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.CloudsmithAccessToken">CloudsmithAccessToken
- </h3>
- <p>
- <p>CloudsmithAccessToken generates Cloudsmith access token using OIDC authentication</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.CloudsmithAccessTokenSpec">
- CloudsmithAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL configures the Cloudsmith API URL. Defaults to <a href="https://api.cloudsmith.io">https://api.cloudsmith.io</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>orgSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>OrgSlug is the organization slug in Cloudsmith</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServiceSlug is the service slug in Cloudsmith for OIDC authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Name of the service account you are federating with</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.CloudsmithAccessTokenSpec">CloudsmithAccessTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.CloudsmithAccessToken">CloudsmithAccessToken</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>CloudsmithAccessTokenSpec defines the configuration for generating a Cloudsmith access token using OIDC authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>apiUrl</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>APIURL configures the Cloudsmith API URL. Defaults to <a href="https://api.cloudsmith.io">https://api.cloudsmith.io</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>orgSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>OrgSlug is the organization slug in Cloudsmith</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceSlug</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ServiceSlug is the service slug in Cloudsmith for OIDC authentication</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Name of the service account you are federating with</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ClusterGenerator">ClusterGenerator
- </h3>
- <p>
- <p>ClusterGenerator represents a cluster-wide generator which can be referenced as part of <code>generatorRef</code> fields.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ClusterGeneratorSpec">
- ClusterGeneratorSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorKind">
- GeneratorKind
- </a>
- </em>
- </td>
- <td>
- <p>Kind the kind of this generator.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>generator</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">
- GeneratorSpec
- </a>
- </em>
- </td>
- <td>
- <p>Generator the spec for this generator, must match the kind.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ClusterGeneratorSpec">ClusterGeneratorSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ClusterGenerator">ClusterGenerator</a>)
- </p>
- <p>
- <p>ClusterGeneratorSpec defines the desired state of a ClusterGenerator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>kind</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorKind">
- GeneratorKind
- </a>
- </em>
- </td>
- <td>
- <p>Kind the kind of this generator.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>generator</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">
- GeneratorSpec
- </a>
- </em>
- </td>
- <td>
- <p>Generator the spec for this generator, must match the kind.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ControllerClassResource">ControllerClassResource
- </h3>
- <p>
- <p>ControllerClassResource defines a resource that can be assigned to a specific controller class.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- struct{ControllerClass string "json:\"controller\""}
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ECRAuthorizationToken">ECRAuthorizationToken
- </h3>
- <p>
- <p>ECRAuthorizationToken uses the GetAuthorizationToken API to retrieve an authorization token.
- The authorization token is valid for 12 hours.
- The authorizationToken returned is a base64 encoded string that can be decoded
- and used in a docker login command to authenticate to a registry.
- For more information, see Registry authentication (<a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth">https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth</a>) in the Amazon Elastic Container Registry User Guide.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ECRAuthorizationTokenSpec">
- ECRAuthorizationTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region specifies the region to operate in.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines how to authenticate with AWS</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>You can assume a role before making calls to the
- desired AWS service.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scope</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Scope specifies the ECR service scope.
- Valid options are private and public.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.ECRAuthorizationTokenSpec">ECRAuthorizationTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ECRAuthorizationToken">ECRAuthorizationToken</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>ECRAuthorizationTokenSpec defines the desired state to generate an AWS ECR authorization token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region specifies the region to operate in.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines how to authenticate with AWS</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>You can assume a role before making calls to the
- desired AWS service.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scope</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Scope specifies the ECR service scope.
- Valid options are private and public.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.Fake">Fake
- </h3>
- <p>
- <p>Fake generator is used for testing. It lets you define
- a static set of credentials that is always returned.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.FakeSpec">
- FakeSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters VDS based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <p>Data defines the static data returned
- by this generator.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.FakeSpec">FakeSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.Fake">Fake</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>FakeSpec contains the static data.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters VDS based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>data</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <p>Data defines the static data returned
- by this generator.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GCPSMAuth">GCPSMAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GCRAccessTokenSpec">GCRAccessTokenSpec</a>)
- </p>
- <p>
- <p>GCPSMAuth defines the authentication methods for Google Cloud Platform.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuthSecretRef">
- GCPSMAuthSecretRef
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentity</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPWorkloadIdentity">
- GCPWorkloadIdentity
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>workloadIdentityFederation</code></br>
- <em>
- <a href="#external-secrets.io/v1.GCPWorkloadIdentityFederation">
- GCPWorkloadIdentityFederation
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GCPSMAuthSecretRef">GCPSMAuthSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuth">GCPSMAuth</a>)
- </p>
- <p>
- <p>GCPSMAuthSecretRef defines the reference to a secret containing Google Cloud Platform credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretAccessKeySecretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The SecretAccessKey is used for authentication</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GCPWorkloadIdentity">GCPWorkloadIdentity
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuth">GCPSMAuth</a>)
- </p>
- <p>
- <p>GCPWorkloadIdentity defines the configuration for using GCP Workload Identity authentication.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterLocation</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterName</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>clusterProjectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GCRAccessToken">GCRAccessToken
- </h3>
- <p>
- <p>GCRAccessToken generates an GCP access token
- that can be used to authenticate with GCR.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCRAccessTokenSpec">
- GCRAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuth">
- GCPSMAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the means for authenticating with GCP</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID defines which project to use to authenticate with</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GCRAccessTokenSpec">GCRAccessTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GCRAccessToken">GCRAccessToken</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>)
- </p>
- <p>
- <p>GCRAccessTokenSpec defines the desired state to generate a Google Container Registry access token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCPSMAuth">
- GCPSMAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth defines the means for authenticating with GCP</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>ProjectID defines which project to use to authenticate with</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.Generator">Generator
- </h3>
- <p>
- <p>Generator is the common interface for all generators that is actually used to generate whatever is needed.</p>
- </p>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorKind">GeneratorKind
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ClusterGeneratorSpec">ClusterGeneratorSpec</a>)
- </p>
- <p>
- <p>GeneratorKind represents a kind of generator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ACRAccessToken"</p></td>
- <td><p>GeneratorKindACRAccessToken represents an Azure Container Registry access token generator.</p>
- </td>
- </tr><tr><td><p>"BeyondtrustWorkloadCredentialsDynamicSecret"</p></td>
- <td><p>GeneratorKindBeyondtrustWorkloadCredentialsDynamicSecret represents a BeyondTrust Workload Credentials dynamic secret generator.</p>
- </td>
- </tr><tr><td><p>"CloudsmithAccessToken"</p></td>
- <td><p>GeneratorKindCloudsmithAccessToken represents a Cloudsmith access token generator.</p>
- </td>
- </tr><tr><td><p>"ECRAuthorizationToken"</p></td>
- <td><p>GeneratorKindECRAuthorizationToken represents an AWS ECR authorization token generator.</p>
- </td>
- </tr><tr><td><p>"Fake"</p></td>
- <td><p>GeneratorKindFake represents a fake generator for testing purposes.</p>
- </td>
- </tr><tr><td><p>"GCRAccessToken"</p></td>
- <td><p>GeneratorKindGCRAccessToken represents a Google Container Registry access token generator.</p>
- </td>
- </tr><tr><td><p>"GithubAccessToken"</p></td>
- <td><p>GeneratorKindGithubAccessToken represents a GitHub access token generator.</p>
- </td>
- </tr><tr><td><p>"GitlabDeployToken"</p></td>
- <td><p>GeneratorKindGitlabDeployToken represents a GitLab deploy token generator.</p>
- </td>
- </tr><tr><td><p>"Grafana"</p></td>
- <td><p>GeneratorKindGrafana represents a Grafana token generator.</p>
- </td>
- </tr><tr><td><p>"MFA"</p></td>
- <td><p>GeneratorKindMFA represents a Multi-Factor Authentication generator.</p>
- </td>
- </tr><tr><td><p>"Password"</p></td>
- <td><p>GeneratorKindPassword represents a password generator.</p>
- </td>
- </tr><tr><td><p>"QuayAccessToken"</p></td>
- <td><p>GeneratorKindQuayAccessToken represents a Quay access token generator.</p>
- </td>
- </tr><tr><td><p>"SSHKey"</p></td>
- <td><p>GeneratorKindSSHKey represents an SSH key generator.</p>
- </td>
- </tr><tr><td><p>"STSSessionToken"</p></td>
- <td><p>GeneratorKindSTSSessionToken represents an AWS STS session token generator.</p>
- </td>
- </tr><tr><td><p>"UUID"</p></td>
- <td><p>GeneratorKindUUID represents a UUID generator.</p>
- </td>
- </tr><tr><td><p>"VaultDynamicSecret"</p></td>
- <td><p>GeneratorKindVaultDynamicSecret represents a HashiCorp Vault dynamic secret generator.</p>
- </td>
- </tr><tr><td><p>"Webhook"</p></td>
- <td><p>GeneratorKindWebhook represents a webhook-based generator.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="<UNKNOWN_API_GROUP>.GeneratorProviderState">GeneratorProviderState
- </h3>
- <p>
- <p>GeneratorProviderState represents the state of a generator provider that can be stored and retrieved.</p>
- </p>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.ClusterGeneratorSpec">ClusterGeneratorSpec</a>)
- </p>
- <p>
- <p>GeneratorSpec defines the configuration for various supported generator types.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>acrAccessTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ACRAccessTokenSpec">
- ACRAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>beyondtrustWorkloadCredentialsDynamicSecretSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.BeyondtrustWorkloadCredentialsDynamicSecretSpec">
- BeyondtrustWorkloadCredentialsDynamicSecretSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>cloudsmithAccessTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.CloudsmithAccessTokenSpec">
- CloudsmithAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>ecrAuthorizationTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.ECRAuthorizationTokenSpec">
- ECRAuthorizationTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>fakeSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.FakeSpec">
- FakeSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>gcrAccessTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GCRAccessTokenSpec">
- GCRAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>githubAccessTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAccessTokenSpec">
- GithubAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>gitlabDeployTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenSpec">
- GitlabDeployTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>quayAccessTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.QuayAccessTokenSpec">
- QuayAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>passwordSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.PasswordSpec">
- PasswordSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>sshKeySpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.SSHKeySpec">
- SSHKeySpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>stsSessionTokenSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.STSSessionTokenSpec">
- STSSessionTokenSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>uuidSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.UUIDSpec">
- UUIDSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>vaultDynamicSecretSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">
- VaultDynamicSecretSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>webhookSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">
- WebhookSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>grafanaSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaSpec">
- GrafanaSpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>mfaSpec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.MFASpec">
- MFASpec
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorState">GeneratorState
- </h3>
- <p>
- <p>GeneratorState represents the state created and managed by a generator resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateSpec">
- GeneratorStateSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>garbageCollectionDeadline</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>GarbageCollectionDeadline is the time after which the generator state
- will be deleted.
- It is set by the controller which creates the generator state and
- can be set configured by the user.
- If the garbage collection deadline is not set the generator state will not be deleted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resource</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>Resource is the generator manifest that produced the state.
- It is a snapshot of the generator manifest at the time the state was produced.
- This manifest will be used to delete the resource. Any configuration that is referenced
- in the manifest should be available at the time of garbage collection. If that is not the case deletion will
- be blocked by a finalizer.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>state</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>State is the state that was produced by the generator implementation.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateStatus">
- GeneratorStateStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorStateConditionType">GeneratorStateConditionType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateStatusCondition">GeneratorStateStatusCondition</a>)
- </p>
- <p>
- <p>GeneratorStateConditionType represents the type of condition for a generator state.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Ready"</p></td>
- <td><p>GeneratorStateReady indicates the generator state is ready and available.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorStateSpec">GeneratorStateSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorState">GeneratorState</a>)
- </p>
- <p>
- <p>GeneratorStateSpec defines the desired state of a generator state resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>garbageCollectionDeadline</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>GarbageCollectionDeadline is the time after which the generator state
- will be deleted.
- It is set by the controller which creates the generator state and
- can be set configured by the user.
- If the garbage collection deadline is not set the generator state will not be deleted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resource</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>Resource is the generator manifest that produced the state.
- It is a snapshot of the generator manifest at the time the state was produced.
- This manifest will be used to delete the resource. Any configuration that is referenced
- in the manifest should be available at the time of garbage collection. If that is not the case deletion will
- be blocked by a finalizer.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>state</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>State is the state that was produced by the generator implementation.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorStateStatus">GeneratorStateStatus
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorState">GeneratorState</a>)
- </p>
- <p>
- <p>GeneratorStateStatus defines the observed state of a generator state resource.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>conditions</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateStatusCondition">
- []GeneratorStateStatusCondition
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GeneratorStateStatusCondition">GeneratorStateStatusCondition
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateStatus">GeneratorStateStatus</a>)
- </p>
- <p>
- <p>GeneratorStateStatusCondition represents the observed condition of a generator state.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorStateConditionType">
- GeneratorStateConditionType
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>status</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-core">
- Kubernetes core/v1.ConditionStatus
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>reason</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>message</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>lastTransitionTime</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GithubAccessToken">GithubAccessToken
- </h3>
- <p>
- <p>GithubAccessToken generates ghs_ accessToken</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAccessTokenSpec">
- GithubAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the GitHub instance URL. Defaults to <a href="https://github.com/">https://github.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>installID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>repositories</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <p>List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
- is installed to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>permissions</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <p>Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAuth">
- GithubAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how ESO authenticates with a Github instance.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GithubAccessTokenSpec">GithubAccessTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GithubAccessToken">GithubAccessToken</a>)
- </p>
- <p>
- <p>GithubAccessTokenSpec defines the desired state to generate a GitHub access token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the GitHub instance URL. Defaults to <a href="https://github.com/">https://github.com/</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>appID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>installID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>repositories</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <p>List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
- is installed to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>permissions</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <p>Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAuth">
- GithubAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how ESO authenticates with a Github instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GithubAuth">GithubAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAccessTokenSpec">GithubAccessTokenSpec</a>)
- </p>
- <p>
- <p>GithubAuth defines the authentication configuration for GitHub access.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>privateKey</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubSecretRef">
- GithubSecretRef
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GithubSecretRef">GithubSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GithubAuth">GithubAuth</a>)
- </p>
- <p>
- <p>GithubSecretRef references a secret containing GitHub credentials.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GitlabDeployToken">GitlabDeployToken
- </h3>
- <p>
- <p>GitlabDeployToken generates a GitLab deploy token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenSpec">
- GitlabDeployTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>URL configures the GitLab instance URL. Defaults to <a href="https://gitlab.com">https://gitlab.com</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ProjectID is the numeric ID or unescaped path (e.g. group/project) of the
- project to create the deploy token in. The generator URL-escapes paths before
- calling the GitLab API, so do not pre-encode. Mutually exclusive with groupID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>groupID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to
- create the deploy token in. The generator URL-escapes paths before calling the
- GitLab API, so do not pre-encode. Mutually exclusive with projectID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the deploy token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scopes</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenScope">
- []GitlabDeployTokenScope
- </a>
- </em>
- </td>
- <td>
- <p>Scopes granted to the deploy token. At least one scope is required.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expiresAt</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpiresAt is an optional expiry for the deploy token. If omitted the token does
- not expire on the GitLab side and is revoked only when the generator state is
- cleaned up (on regeneration or when the consuming ExternalSecret is deleted).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username is an optional username for the deploy token. GitLab defaults it to
- gitlab+deploy-token-{n} when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenAuth">
- GitlabDeployTokenAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how ESO authenticates with the GitLab API.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GitlabDeployTokenAuth">GitlabDeployTokenAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenSpec">GitlabDeployTokenSpec</a>)
- </p>
- <p>
- <p>GitlabDeployTokenAuth defines the authentication configuration for the GitLab API.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenSecretRef">
- GitlabDeployTokenSecretRef
- </a>
- </em>
- </td>
- <td>
- <p>Token references a secret containing a GitLab access token (personal, group, or
- project) with the api scope and at least the Maintainer role on the target.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GitlabDeployTokenScope">GitlabDeployTokenScope
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenSpec">GitlabDeployTokenSpec</a>)
- </p>
- <p>
- <p>GitlabDeployTokenScope is a scope that can be granted to a GitLab deploy token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"read_package_registry"</p></td>
- <td><p>GitlabDeployTokenScopeReadPackageRegistry allows read access to the package registry.</p>
- </td>
- </tr><tr><td><p>"read_registry"</p></td>
- <td><p>GitlabDeployTokenScopeReadRegistry allows read access to the container registry.</p>
- </td>
- </tr><tr><td><p>"read_repository"</p></td>
- <td><p>GitlabDeployTokenScopeReadRepository allows read access to the repository.</p>
- </td>
- </tr><tr><td><p>"read_virtual_registry"</p></td>
- <td><p>GitlabDeployTokenScopeReadVirtualRegistry allows read access to the virtual registry (projects only).</p>
- </td>
- </tr><tr><td><p>"write_package_registry"</p></td>
- <td><p>GitlabDeployTokenScopeWritePackageRegistry allows write access to the package registry.</p>
- </td>
- </tr><tr><td><p>"write_registry"</p></td>
- <td><p>GitlabDeployTokenScopeWriteRegistry allows write access to the container registry.</p>
- </td>
- </tr><tr><td><p>"write_virtual_registry"</p></td>
- <td><p>GitlabDeployTokenScopeWriteVirtualRegistry allows write access to the virtual registry (projects only).</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GitlabDeployTokenSecretRef">GitlabDeployTokenSecretRef
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenAuth">GitlabDeployTokenAuth</a>)
- </p>
- <p>
- <p>GitlabDeployTokenSecretRef references a secret containing a GitLab access token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GitlabDeployTokenSpec">GitlabDeployTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployToken">GitlabDeployToken</a>)
- </p>
- <p>
- <p>GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>URL configures the GitLab instance URL. Defaults to <a href="https://gitlab.com">https://gitlab.com</a>.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>projectID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ProjectID is the numeric ID or unescaped path (e.g. group/project) of the
- project to create the deploy token in. The generator URL-escapes paths before
- calling the GitLab API, so do not pre-encode. Mutually exclusive with groupID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>groupID</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to
- create the deploy token in. The generator URL-escapes paths before calling the
- GitLab API, so do not pre-encode. Mutually exclusive with projectID.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the deploy token.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>scopes</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenScope">
- []GitlabDeployTokenScope
- </a>
- </em>
- </td>
- <td>
- <p>Scopes granted to the deploy token. At least one scope is required.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>expiresAt</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>ExpiresAt is an optional expiry for the deploy token. If omitted the token does
- not expire on the GitLab side and is revoked only when the generator state is
- cleaned up (on regeneration or when the consuming ExternalSecret is deleted).</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Username is an optional username for the deploy token. GitLab defaults it to
- gitlab+deploy-token-{n} when omitted.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GitlabDeployTokenAuth">
- GitlabDeployTokenAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth configures how ESO authenticates with the GitLab API.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.Grafana">Grafana
- </h3>
- <p>
- <p>Grafana represents a generator for Grafana service account tokens.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaSpec">
- GrafanaSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL is the URL of the Grafana instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaAuth">
- GrafanaAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth is the authentication configuration to authenticate
- against the Grafana instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccount</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaServiceAccount">
- GrafanaServiceAccount
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccount is the configuration for the service account that
- is supposed to be generated by the generator.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaAuth">GrafanaAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaSpec">GrafanaSpec</a>)
- </p>
- <p>
- <p>GrafanaAuth defines the authentication methods for connecting to a Grafana instance.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>token</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.SecretKeySelector">
- SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>A service account token used to authenticate against the Grafana instance.
- Note: you need a token which has elevated permissions to create service accounts.
- See here for the documentation on basic roles offered by Grafana:
- <a href="https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/">https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>basic</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaBasicAuth">
- GrafanaBasicAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Basic auth credentials used to authenticate against the Grafana instance.
- Note: you need a token which has elevated permissions to create service accounts.
- See here for the documentation on basic roles offered by Grafana:
- <a href="https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/">https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/</a></p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaBasicAuth">GrafanaBasicAuth
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaAuth">GrafanaAuth</a>)
- </p>
- <p>
- <p>GrafanaBasicAuth defines the credentials for basic authentication with Grafana.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>username</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>A basic auth username used to authenticate against the Grafana instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>password</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.SecretKeySelector">
- SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>A basic auth password used to authenticate against the Grafana instance.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaServiceAccount">GrafanaServiceAccount
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaSpec">GrafanaSpec</a>)
- </p>
- <p>
- <p>GrafanaServiceAccount defines the configuration for a Grafana service account to be created.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name is the name of the service account that will be created by ESO.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Role is the role of the service account.
- See here for the documentation on basic roles offered by Grafana:
- <a href="https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/">https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/</a></p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secondsToLive</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecondsToLive is the number of seconds before the generated service account token will expire.
- Some Grafana deployments (e.g. AWS Managed Grafana) require this value to be set.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaServiceAccountTokenState">GrafanaServiceAccountTokenState
- </h3>
- <p>
- <p>GrafanaServiceAccountTokenState is the state type produced by the Grafana generator.
- It contains the service account ID, login and token ID which is enough to
- identify the service account.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>serviceAccount</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaStateServiceAccount">
- GrafanaStateServiceAccount
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaSpec">GrafanaSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.Grafana">Grafana</a>)
- </p>
- <p>
- <p>GrafanaSpec controls the behavior of the grafana generator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL is the URL of the Grafana instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaAuth">
- GrafanaAuth
- </a>
- </em>
- </td>
- <td>
- <p>Auth is the authentication configuration to authenticate
- against the Grafana instance.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccount</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaServiceAccount">
- GrafanaServiceAccount
- </a>
- </em>
- </td>
- <td>
- <p>ServiceAccount is the configuration for the service account that
- is supposed to be generated by the generator.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.GrafanaStateServiceAccount">GrafanaStateServiceAccount
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaServiceAccountTokenState">GrafanaServiceAccountTokenState</a>)
- </p>
- <p>
- <p>GrafanaStateServiceAccount contains the service account ID, login and token ID.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>id</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>login</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenID</code></br>
- <em>
- int64
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.MFA">MFA
- </h3>
- <p>
- <p>MFA generates a new TOTP token that is compliant with RFC 6238.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.MFASpec">
- MFASpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>secret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Secret is a secret selector to a secret containing the seed secret to generate the TOTP value from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>length</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Length defines the token length. Defaults to 6 characters.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timePeriod</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>TimePeriod defines how long the token can be active. Defaults to 30 seconds.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>algorithm</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Algorithm to use for encoding. Defaults to SHA1 as per the RFC.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>when</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>When defines a time parameter that can be used to pin the origin time of the generated token.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.MFASpec">MFASpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.MFA">MFA</a>)
- </p>
- <p>
- <p>MFASpec controls the behavior of the mfa generator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>secret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Secret is a secret selector to a secret containing the seed secret to generate the TOTP value from.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>length</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Length defines the token length. Defaults to 6 characters.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timePeriod</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>TimePeriod defines how long the token can be active. Defaults to 30 seconds.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>algorithm</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Algorithm to use for encoding. Defaults to SHA1 as per the RFC.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>when</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta">
- Kubernetes meta/v1.Time
- </a>
- </em>
- </td>
- <td>
- <p>When defines a time parameter that can be used to pin the origin time of the generated token.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.NTLMProtocol">NTLMProtocol
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.AuthorizationProtocol">AuthorizationProtocol</a>)
- </p>
- <p>
- <p>NTLMProtocol contains the NTLM-specific configuration.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>usernameSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- <tr>
- <td>
- <code>passwordSecret</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
- External Secrets meta/v1.SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.Password">Password
- </h3>
- <p>
- <p>Password generates a random password based on the
- configuration parameters in spec.
- You can specify the length, characterset and other attributes.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.PasswordSpec">
- PasswordSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>length</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Length of the password to be generated.
- Defaults to 24</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>digits</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Digits specifies the number of digits in the generated
- password. If omitted it defaults to 25% of the length of the password</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>symbols</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Symbols specifies the number of symbol characters in the generated
- password. If omitted it defaults to 25% of the length of the password</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>symbolCharacters</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SymbolCharacters specifies the special characters that should be used
- in the generated password.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>noUpper</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>Set NoUpper to disable uppercase characters</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>allowRepeat</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>set AllowRepeat to true to allow repeating characters.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretKeys</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretKeys defines the keys that will be populated with generated passwords.
- Defaults to “password” when not set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>encoding</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Encoding specifies the encoding of the generated password.
- Valid values are:
- - “raw” (default): no encoding
- - “base64”: standard base64 encoding
- - “base64url”: base64url encoding
- - “base32”: base32 encoding
- - “hex”: hexadecimal encoding</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.PasswordSpec">PasswordSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.Password">Password</a>)
- </p>
- <p>
- <p>PasswordSpec controls the behavior of the password generator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>length</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Length of the password to be generated.
- Defaults to 24</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>digits</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Digits specifies the number of digits in the generated
- password. If omitted it defaults to 25% of the length of the password</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>symbols</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>Symbols specifies the number of symbol characters in the generated
- password. If omitted it defaults to 25% of the length of the password</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>symbolCharacters</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>SymbolCharacters specifies the special characters that should be used
- in the generated password.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>noUpper</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>Set NoUpper to disable uppercase characters</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>allowRepeat</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <p>set AllowRepeat to true to allow repeating characters.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretKeys</code></br>
- <em>
- []string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SecretKeys defines the keys that will be populated with generated passwords.
- Defaults to “password” when not set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>encoding</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Encoding specifies the encoding of the generated password.
- Valid values are:
- - “raw” (default): no encoding
- - “base64”: standard base64 encoding
- - “base64url”: base64url encoding
- - “base32”: base32 encoding
- - “hex”: hexadecimal encoding</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.QuayAccessToken">QuayAccessToken
- </h3>
- <p>
- <p>QuayAccessToken generates Quay oauth token for pulling/pushing images</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.QuayAccessTokenSpec">
- QuayAccessTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Quay instance URL. Defaults to quay.io.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>robotAccount</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the robot account you are federating with</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Name of the service account you are federating with</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.QuayAccessTokenSpec">QuayAccessTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.QuayAccessToken">QuayAccessToken</a>)
- </p>
- <p>
- <p>QuayAccessTokenSpec defines the desired state to generate a Quay access token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>URL configures the Quay instance URL. Defaults to quay.io.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>robotAccount</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of the robot account you are federating with</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>serviceAccountRef</code></br>
- <em>
- <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
- External Secrets meta/v1.ServiceAccountSelector
- </a>
- </em>
- </td>
- <td>
- <p>Name of the service account you are federating with</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.RequestParameters">RequestParameters
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.STSSessionTokenSpec">STSSessionTokenSpec</a>)
- </p>
- <p>
- <p>RequestParameters contains parameters that can be passed to the STS service.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>sessionDuration</code></br>
- <em>
- int32
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- </td>
- </tr>
- <tr>
- <td>
- <code>serialNumber</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
- the GetSessionToken call.
- Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
- (such as arn:aws:iam::123456789012:mfa/user)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>tokenCode</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>TokenCode is the value provided by the MFA device, if MFA is required.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.SSHKey">SSHKey
- </h3>
- <p>
- <p>SSHKey generates SSH key pairs.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.SSHKeySpec">
- SSHKeySpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>keyType</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>KeyType specifies the SSH key type (rsa, ecdsa, ed25519)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keySize</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>KeySize specifies the key size for RSA keys (default: 2048) and ECDSA keys (default: 256).
- For RSA keys: 2048, 3072, 4096
- For ECDSA keys: 256, 384, 521
- Ignored for ed25519 keys</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>comment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Comment specifies an optional comment for the SSH key</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.SSHKeySpec">SSHKeySpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.SSHKey">SSHKey</a>)
- </p>
- <p>
- <p>SSHKeySpec controls the behavior of the ssh key generator.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>keyType</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>KeyType specifies the SSH key type (rsa, ecdsa, ed25519)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>keySize</code></br>
- <em>
- int
- </em>
- </td>
- <td>
- <p>KeySize specifies the key size for RSA keys (default: 2048) and ECDSA keys (default: 256).
- For RSA keys: 2048, 3072, 4096
- For ECDSA keys: 256, 384, 521
- Ignored for ed25519 keys</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>comment</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Comment specifies an optional comment for the SSH key</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.STSSessionToken">STSSessionToken
- </h3>
- <p>
- <p>STSSessionToken uses the GetSessionToken API to retrieve an authorization token.
- The authorization token is valid for 12 hours.
- The authorizationToken returned is a base64 encoded string that can be decoded.
- For more information, see GetSessionToken (<a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html">https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html</a>).</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.STSSessionTokenSpec">
- STSSessionTokenSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region specifies the region to operate in.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines how to authenticate with AWS</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>You can assume a role before making calls to the
- desired AWS service.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>requestParameters</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.RequestParameters">
- RequestParameters
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RequestParameters contains parameters that can be passed to the STS service.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.STSSessionTokenSpec">STSSessionTokenSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.STSSessionToken">STSSessionToken</a>)
- </p>
- <p>
- <p>STSSessionTokenSpec defines the desired state to generate an AWS STS session token.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>region</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Region specifies the region to operate in.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AWSAuth">
- AWSAuth
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth defines how to authenticate with AWS</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>role</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>You can assume a role before making calls to the
- desired AWS service.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>requestParameters</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.RequestParameters">
- RequestParameters
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>RequestParameters contains parameters that can be passed to the STS service.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.SecretKeySelector">SecretKeySelector
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaAuth">GrafanaAuth</a>,
- <a href="#generators.external-secrets.io/v1alpha1.GrafanaBasicAuth">GrafanaBasicAuth</a>,
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSecret">WebhookSecret</a>)
- </p>
- <p>
- <p>SecretKeySelector defines a reference to a specific key within a Kubernetes Secret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the Secret resource being referred to.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the token is found.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.StatefulResource">StatefulResource
- </h3>
- <p>
- <p>StatefulResource represents a Kubernetes resource that has state which can be tracked.</p>
- </p>
- <h3 id="generators.external-secrets.io/v1alpha1.UUID">UUID
- </h3>
- <p>
- <p>UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216).</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.UUIDSpec">
- UUIDSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.UUIDSpec">UUIDSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.UUID">UUID</a>)
- </p>
- <p>
- <p>UUIDSpec controls the behavior of the uuid generator.</p>
- </p>
- <h3 id="generators.external-secrets.io/v1alpha1.VaultDynamicSecret">VaultDynamicSecret
- </h3>
- <p>
- <p>VaultDynamicSecret represents a generator that can create dynamic secrets from HashiCorp Vault.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">
- VaultDynamicSecretSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters VDS based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault API method to use (GET/POST/other)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>parameters</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>Parameters to pass to Vault write (for non-GET methods)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>getParameters</code></br>
- <em>
- map[string][]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GetParameters are query-string parameters passed to Vault on GET calls.
- Each key may map to multiple values, matching HTTP query-string semantics.
- Ignored for non-GET methods; use Parameters for write bodies.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resultType</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretResultType">
- VaultDynamicSecretResultType
- </a>
- </em>
- </td>
- <td>
- <p>Result type defines which data is returned from the generator.
- By default, it is the “data” section of the Vault API response.
- When using e.g. /auth/token/create the “data” section is empty but
- the “auth” section contains the generated token.
- Please refer to the vault docs regarding the result data structure.
- Additionally, accessing the raw response is possibly by using “Raw” result type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure http retries if failed</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultProvider">
- VaultProvider
- </a>
- </em>
- </td>
- <td>
- <p>Vault provider common spec</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault path to obtain the dynamic secret from</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>allowEmptyResponse</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Do not fail if no secrets are found. Useful for requests where no data is expected.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.VaultDynamicSecretResultType">VaultDynamicSecretResultType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">VaultDynamicSecretSpec</a>)
- </p>
- <p>
- <p>VaultDynamicSecretResultType defines which part of the Vault API response should be returned.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"Auth"</p></td>
- <td><p>VaultDynamicSecretResultTypeAuth specifies to return the “auth” section of the Vault API response.</p>
- </td>
- </tr><tr><td><p>"Data"</p></td>
- <td><p>VaultDynamicSecretResultTypeData specifies to return the “data” section of the Vault API response.</p>
- </td>
- </tr><tr><td><p>"Raw"</p></td>
- <td><p>VaultDynamicSecretResultTypeRaw specifies to return the raw response from the Vault API.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.VaultDynamicSecretSpec">VaultDynamicSecretSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecret">VaultDynamicSecret</a>)
- </p>
- <p>
- <p>VaultDynamicSecretSpec defines the desired spec of VaultDynamicSecret.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>controller</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to select the correct ESO controller (think: ingress.ingressClassName)
- The ESO controller is instantiated with a specific controller name and filters VDS based on this property</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault API method to use (GET/POST/other)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>parameters</code></br>
- <em>
- k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
- </em>
- </td>
- <td>
- <p>Parameters to pass to Vault write (for non-GET methods)</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>getParameters</code></br>
- <em>
- map[string][]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>GetParameters are query-string parameters passed to Vault on GET calls.
- Each key may map to multiple values, matching HTTP query-string semantics.
- Ignored for non-GET methods; use Parameters for write bodies.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>resultType</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.VaultDynamicSecretResultType">
- VaultDynamicSecretResultType
- </a>
- </em>
- </td>
- <td>
- <p>Result type defines which data is returned from the generator.
- By default, it is the “data” section of the Vault API response.
- When using e.g. /auth/token/create the “data” section is empty but
- the “auth” section contains the generated token.
- Please refer to the vault docs regarding the result data structure.
- Additionally, accessing the raw response is possibly by using “Raw” result type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>retrySettings</code></br>
- <em>
- <a href="#external-secrets.io/v1.SecretStoreRetrySettings">
- SecretStoreRetrySettings
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Used to configure http retries if failed</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>provider</code></br>
- <em>
- <a href="#external-secrets.io/v1.VaultProvider">
- VaultProvider
- </a>
- </em>
- </td>
- <td>
- <p>Vault provider common spec</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>path</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Vault path to obtain the dynamic secret from</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>allowEmptyResponse</code></br>
- <em>
- bool
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Do not fail if no secrets are found. Useful for requests where no data is expected.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.Webhook">Webhook
- </h3>
- <p>
- <p>Webhook connects to a third party API server to handle the secrets generation
- configuration parameters in spec.
- You can specify the server, the token, and additional body parameters.
- See documentation for the full API specification for requests and responses.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>metadata</code></br>
- <em>
- <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta">
- Kubernetes meta/v1.ObjectMeta
- </a>
- </em>
- </td>
- <td>
- Refer to the Kubernetes API documentation for the fields of the
- <code>metadata</code> field.
- </td>
- </tr>
- <tr>
- <td>
- <code>spec</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">
- WebhookSpec
- </a>
- </em>
- </td>
- <td>
- <br/>
- <br/>
- <table>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook Method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook url to call</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AuthorizationProtocol">
- AuthorizationProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth specifies a authorization protocol. Only one protocol may be set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>body</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Body</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timeout</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Timeout</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>result</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookResult">
- WebhookResult
- </a>
- </em>
- </td>
- <td>
- <p>Result formatting</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secrets</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSecret">
- []WebhookSecret
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secrets to fill in templates
- These secrets will be passed to the templating function as key value pairs under the given name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate webhook server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookCAProvider">
- WebhookCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate webhook server certificate.</p>
- </td>
- </tr>
- </table>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.WebhookCAProvider">WebhookCAProvider
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">WebhookSpec</a>)
- </p>
- <p>
- <p>WebhookCAProvider defines a location to fetch the cert for the webhook provider from.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>type</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookCAProviderType">
- WebhookCAProviderType
- </a>
- </em>
- </td>
- <td>
- <p>The type of provider to use such as “Secret”, or “ConfigMap”.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The name of the object located at the provider type.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>key</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>The key where the CA certificate can be found in the Secret or ConfigMap.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>namespace</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The namespace the Provider type is in.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.WebhookCAProviderType">WebhookCAProviderType
- (<code>string</code> alias)</p></h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookCAProvider">WebhookCAProvider</a>)
- </p>
- <p>
- <p>WebhookCAProviderType defines the type of provider for webhook CA certificates.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Value</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody><tr><td><p>"ConfigMap"</p></td>
- <td><p>WebhookCAProviderTypeConfigMap indicates the CA provider is a ConfigMap resource.</p>
- </td>
- </tr><tr><td><p>"Secret"</p></td>
- <td><p>WebhookCAProviderTypeSecret indicates the CA provider is a Secret resource.</p>
- </td>
- </tr></tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.WebhookResult">WebhookResult
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">WebhookSpec</a>)
- </p>
- <p>
- <p>WebhookResult defines how to format and extract results from the webhook response.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>jsonPath</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Json path of return value</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.WebhookSecret">WebhookSecret
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSpec">WebhookSpec</a>)
- </p>
- <p>
- <p>WebhookSecret defines a secret reference that will be used in webhook templates.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>name</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Name of this secret in templates</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secretRef</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.SecretKeySelector">
- SecretKeySelector
- </a>
- </em>
- </td>
- <td>
- <p>Secret ref to fill in credentials</p>
- </td>
- </tr>
- </tbody>
- </table>
- <h3 id="generators.external-secrets.io/v1alpha1.WebhookSpec">WebhookSpec
- </h3>
- <p>
- (<em>Appears on:</em>
- <a href="#generators.external-secrets.io/v1alpha1.GeneratorSpec">GeneratorSpec</a>,
- <a href="#generators.external-secrets.io/v1alpha1.Webhook">Webhook</a>)
- </p>
- <p>
- <p>WebhookSpec controls the behavior of the external generator. Any body parameters should be passed to the server through the parameters field.</p>
- </p>
- <table>
- <thead>
- <tr>
- <th>Field</th>
- <th>Description</th>
- </tr>
- </thead>
- <tbody>
- <tr>
- <td>
- <code>method</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook Method</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>url</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <p>Webhook url to call</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>headers</code></br>
- <em>
- map[string]string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Headers</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>auth</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.AuthorizationProtocol">
- AuthorizationProtocol
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Auth specifies a authorization protocol. Only one protocol may be set.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>body</code></br>
- <em>
- string
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Body</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>timeout</code></br>
- <em>
- <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
- Kubernetes meta/v1.Duration
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Timeout</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>result</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookResult">
- WebhookResult
- </a>
- </em>
- </td>
- <td>
- <p>Result formatting</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>secrets</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookSecret">
- []WebhookSecret
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>Secrets to fill in templates
- These secrets will be passed to the templating function as key value pairs under the given name</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caBundle</code></br>
- <em>
- []byte
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>PEM encoded CA bundle used to validate webhook server certificate. Only used
- if the Server URL is using HTTPS protocol. This parameter is ignored for
- plain HTTP protocol connection. If not set the system root certificates
- are used to validate the TLS connection.</p>
- </td>
- </tr>
- <tr>
- <td>
- <code>caProvider</code></br>
- <em>
- <a href="#generators.external-secrets.io/v1alpha1.WebhookCAProvider">
- WebhookCAProvider
- </a>
- </em>
- </td>
- <td>
- <em>(Optional)</em>
- <p>The provider for the CA bundle to use to validate webhook server certificate.</p>
- </td>
- </tr>
- </tbody>
- </table>
- <hr/>
- <p><em>
- Generated with <code>gen-crd-api-reference-docs</code>.
- </em></p>
-
-
- </article>
- </div>
-
-
- <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
- </div>
-
- </main>
-
- <img referrerpolicy="no-referrer-when-downgrade"
- src="https://static.scarf.sh/a.png?x-pxid=6658a9eb-067d-49f1-94f2-b8b00f21451e" alt=""
- hidden />
-
- <footer class="md-footer">
-
- <div class="md-footer-meta md-typeset">
- <div class="md-footer-meta__inner md-grid">
- <div class="md-copyright">
-
- <div class="md-copyright__highlight">
- © 2025 The external-secrets Authors.<br/>
- © 2025 The Linux Foundation. All rights reserved.<br/><br/>
- The Linux Foundation has registered trademarks and uses trademarks.<br/>
- For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage/">Trademark Usage page</a>.
- </div>
-
-
- Made with
- <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
- Material for MkDocs
- </a>
-
- </div>
-
- </div>
- </div>
- </footer>
-
- </div>
- <div class="md-dialog" data-md-component="dialog">
- <div class="md-dialog__inner md-typeset"></div>
- </div>
-
-
-
-
-
- <script id="__config" type="application/json">{"annotate": null, "base": "../..", "features": ["navigation.tabs", "navigation.indexes", "navigation.expand"], "search": "../../assets/javascripts/workers/search.2c215733.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"provider": "mike"}}</script>
-
-
- <script src="../../assets/javascripts/bundle.d7400e89.min.js"></script>
-
-
- </body>
- </html>
|
