index.html 47 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436
  1. <!doctype html>
  2. <html lang="en" class="no-js">
  3. <head>
  4. <meta charset="utf-8">
  5. <meta name="viewport" content="width=device-width,initial-scale=1">
  6. <link rel="icon" href="../assets/images/favicon.png">
  7. <meta name="generator" content="mkdocs-1.1, mkdocs-material-7.1.8">
  8. <title>GitOps using FluxCD - External Secrets Operator</title>
  9. <link rel="stylesheet" href="../assets/stylesheets/main.ca7ac06f.min.css">
  10. <link rel="stylesheet" href="../assets/stylesheets/palette.f1a3b89f.min.css">
  11. <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  12. <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700%7CRoboto+Mono&display=fallback">
  13. <style>:root{--md-text-font-family:"Roboto";--md-code-font-family:"Roboto Mono"}</style>
  14. <script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",function(){"undefined"!=typeof location$&&location$.subscribe(function(t){gtag("config","G-QP38TD8K7V",{page_path:t.pathname})})})</script>
  15. <script async src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V"></script>
  16. </head>
  17. <body dir="ltr" data-md-color-scheme="" data-md-color-primary="none" data-md-color-accent="none">
  18. <script>function __prefix(e){return new URL("..",location).pathname+"."+e}function __get(e,t=localStorage){return JSON.parse(t.getItem(__prefix(e)))}</script>
  19. <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
  20. <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
  21. <label class="md-overlay" for="__drawer"></label>
  22. <div data-md-component="skip">
  23. <a href="#gitops-using-fluxcd-v2" class="md-skip">
  24. Skip to content
  25. </a>
  26. </div>
  27. <div data-md-component="announce">
  28. </div>
  29. <header class="md-header" data-md-component="header">
  30. <nav class="md-header__inner md-grid" aria-label="Header">
  31. <a href=".." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
  32. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54z"/></svg>
  33. </a>
  34. <label class="md-header__button md-icon" for="__drawer">
  35. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
  36. </label>
  37. <div class="md-header__title" data-md-component="header-title">
  38. <div class="md-header__ellipsis">
  39. <div class="md-header__topic">
  40. <span class="md-ellipsis">
  41. External Secrets Operator
  42. </span>
  43. </div>
  44. <div class="md-header__topic" data-md-component="header-topic">
  45. <span class="md-ellipsis">
  46. GitOps using FluxCD
  47. </span>
  48. </div>
  49. </div>
  50. </div>
  51. <label class="md-header__button md-icon" for="__search">
  52. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
  53. </label>
  54. <div class="md-search" data-md-component="search" role="dialog">
  55. <label class="md-search__overlay" for="__search"></label>
  56. <div class="md-search__inner" role="search">
  57. <form class="md-search__form" name="search">
  58. <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" data-md-state="active" required>
  59. <label class="md-search__icon md-icon" for="__search">
  60. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
  61. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
  62. </label>
  63. <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
  64. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
  65. </button>
  66. </form>
  67. <div class="md-search__output">
  68. <div class="md-search__scrollwrap" data-md-scrollfix>
  69. <div class="md-search-result" data-md-component="search-result">
  70. <div class="md-search-result__meta">
  71. Initializing search
  72. </div>
  73. <ol class="md-search-result__list"></ol>
  74. </div>
  75. </div>
  76. </div>
  77. </div>
  78. </div>
  79. <div class="md-header__source">
  80. <a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-component="source">
  81. <div class="md-source__icon md-icon">
  82. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  83. </div>
  84. <div class="md-source__repository">
  85. External Secrets Operator
  86. </div>
  87. </a>
  88. </div>
  89. </nav>
  90. </header>
  91. <div class="md-container" data-md-component="container">
  92. <main class="md-main" data-md-component="main">
  93. <div class="md-main__inner md-grid">
  94. <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
  95. <div class="md-sidebar__scrollwrap">
  96. <div class="md-sidebar__inner">
  97. <nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
  98. <label class="md-nav__title" for="__drawer">
  99. <a href=".." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
  100. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54z"/></svg>
  101. </a>
  102. External Secrets Operator
  103. </label>
  104. <div class="md-nav__source">
  105. <a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-component="source">
  106. <div class="md-source__icon md-icon">
  107. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  108. </div>
  109. <div class="md-source__repository">
  110. External Secrets Operator
  111. </div>
  112. </a>
  113. </div>
  114. <ul class="md-nav__list" data-md-scrollfix>
  115. <li class="md-nav__item">
  116. <a href=".." class="md-nav__link">
  117. Introduction
  118. </a>
  119. </li>
  120. <li class="md-nav__item">
  121. <a href="../api-overview/" class="md-nav__link">
  122. Overview
  123. </a>
  124. </li>
  125. <li class="md-nav__item md-nav__item--nested">
  126. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3" type="checkbox" id="__nav_3" >
  127. <label class="md-nav__link" for="__nav_3">
  128. API Types
  129. <span class="md-nav__icon md-icon"></span>
  130. </label>
  131. <nav class="md-nav" aria-label="API Types" data-md-level="1">
  132. <label class="md-nav__title" for="__nav_3">
  133. <span class="md-nav__icon md-icon"></span>
  134. API Types
  135. </label>
  136. <ul class="md-nav__list" data-md-scrollfix>
  137. <li class="md-nav__item">
  138. <a href="../api-externalsecret/" class="md-nav__link">
  139. ExternalSecret
  140. </a>
  141. </li>
  142. <li class="md-nav__item">
  143. <a href="../api-secretstore/" class="md-nav__link">
  144. SecretStore
  145. </a>
  146. </li>
  147. <li class="md-nav__item">
  148. <a href="../api-clustersecretstore/" class="md-nav__link">
  149. ClusterSecretStore
  150. </a>
  151. </li>
  152. </ul>
  153. </nav>
  154. </li>
  155. <li class="md-nav__item md-nav__item--active md-nav__item--nested">
  156. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4" type="checkbox" id="__nav_4" checked>
  157. <label class="md-nav__link" for="__nav_4">
  158. Guides
  159. <span class="md-nav__icon md-icon"></span>
  160. </label>
  161. <nav class="md-nav" aria-label="Guides" data-md-level="1">
  162. <label class="md-nav__title" for="__nav_4">
  163. <span class="md-nav__icon md-icon"></span>
  164. Guides
  165. </label>
  166. <ul class="md-nav__list" data-md-scrollfix>
  167. <li class="md-nav__item">
  168. <a href="../guides-introduction/" class="md-nav__link">
  169. Introduction
  170. </a>
  171. </li>
  172. <li class="md-nav__item">
  173. <a href="../guides-getting-started/" class="md-nav__link">
  174. Getting started
  175. </a>
  176. </li>
  177. <li class="md-nav__item">
  178. <a href="../guides-templating/" class="md-nav__link">
  179. Advanced Templating
  180. </a>
  181. </li>
  182. <li class="md-nav__item">
  183. <a href="../guides-all-keys-one-secret/" class="md-nav__link">
  184. All keys, One secret
  185. </a>
  186. </li>
  187. <li class="md-nav__item">
  188. <a href="../guides-common-k8s-secret-types/" class="md-nav__link">
  189. Common K8S Secret Types
  190. </a>
  191. </li>
  192. <li class="md-nav__item">
  193. <a href="../guides-multi-tenancy/" class="md-nav__link">
  194. Multi Tenancy
  195. </a>
  196. </li>
  197. <li class="md-nav__item">
  198. <a href="../guides-metrics/" class="md-nav__link">
  199. Metrics
  200. </a>
  201. </li>
  202. <li class="md-nav__item">
  203. <a href="../guides-using-latest-image/" class="md-nav__link">
  204. Using Latest Image
  205. </a>
  206. </li>
  207. <li class="md-nav__item md-nav__item--active">
  208. <input class="md-nav__toggle md-toggle" data-md-toggle="toc" type="checkbox" id="__toc">
  209. <label class="md-nav__link md-nav__link--active" for="__toc">
  210. GitOps using FluxCD
  211. <span class="md-nav__icon md-icon"></span>
  212. </label>
  213. <a href="./" class="md-nav__link md-nav__link--active">
  214. GitOps using FluxCD
  215. </a>
  216. <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  217. <label class="md-nav__title" for="__toc">
  218. <span class="md-nav__icon md-icon"></span>
  219. Table of contents
  220. </label>
  221. <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
  222. <li class="md-nav__item">
  223. <a href="#advantages" class="md-nav__link">
  224. Advantages
  225. </a>
  226. </li>
  227. <li class="md-nav__item">
  228. <a href="#the-approach" class="md-nav__link">
  229. The approach
  230. </a>
  231. </li>
  232. <li class="md-nav__item">
  233. <a href="#the-problem" class="md-nav__link">
  234. The problem
  235. </a>
  236. </li>
  237. <li class="md-nav__item">
  238. <a href="#the-solution" class="md-nav__link">
  239. The solution
  240. </a>
  241. </li>
  242. <li class="md-nav__item">
  243. <a href="#create-the-main-kustomization" class="md-nav__link">
  244. Create the main kustomization
  245. </a>
  246. </li>
  247. <li class="md-nav__item">
  248. <a href="#create-the-secret" class="md-nav__link">
  249. Create the secret
  250. </a>
  251. </li>
  252. <li class="md-nav__item">
  253. <a href="#creating-the-references-to-repositories" class="md-nav__link">
  254. Creating the references to repositories
  255. </a>
  256. </li>
  257. <li class="md-nav__item">
  258. <a href="#deploy-the-crds" class="md-nav__link">
  259. Deploy the CRDs
  260. </a>
  261. </li>
  262. <li class="md-nav__item">
  263. <a href="#deploy-the-operator" class="md-nav__link">
  264. Deploy the operator
  265. </a>
  266. </li>
  267. <li class="md-nav__item">
  268. <a href="#deploy-the-crs" class="md-nav__link">
  269. Deploy the CRs
  270. </a>
  271. </li>
  272. <li class="md-nav__item">
  273. <a href="#results" class="md-nav__link">
  274. Results
  275. </a>
  276. </li>
  277. </ul>
  278. </nav>
  279. </li>
  280. </ul>
  281. </nav>
  282. </li>
  283. <li class="md-nav__item md-nav__item--nested">
  284. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5" type="checkbox" id="__nav_5" >
  285. <label class="md-nav__link" for="__nav_5">
  286. Provider
  287. <span class="md-nav__icon md-icon"></span>
  288. </label>
  289. <nav class="md-nav" aria-label="Provider" data-md-level="1">
  290. <label class="md-nav__title" for="__nav_5">
  291. <span class="md-nav__icon md-icon"></span>
  292. Provider
  293. </label>
  294. <ul class="md-nav__list" data-md-scrollfix>
  295. <li class="md-nav__item md-nav__item--nested">
  296. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_1" type="checkbox" id="__nav_5_1" >
  297. <label class="md-nav__link" for="__nav_5_1">
  298. AWS
  299. <span class="md-nav__icon md-icon"></span>
  300. </label>
  301. <nav class="md-nav" aria-label="AWS" data-md-level="2">
  302. <label class="md-nav__title" for="__nav_5_1">
  303. <span class="md-nav__icon md-icon"></span>
  304. AWS
  305. </label>
  306. <ul class="md-nav__list" data-md-scrollfix>
  307. <li class="md-nav__item">
  308. <a href="../provider-aws-secrets-manager/" class="md-nav__link">
  309. Secrets Manager
  310. </a>
  311. </li>
  312. <li class="md-nav__item">
  313. <a href="../provider-aws-parameter-store/" class="md-nav__link">
  314. Parameter Store
  315. </a>
  316. </li>
  317. </ul>
  318. </nav>
  319. </li>
  320. <li class="md-nav__item md-nav__item--nested">
  321. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_2" type="checkbox" id="__nav_5_2" >
  322. <label class="md-nav__link" for="__nav_5_2">
  323. Azure
  324. <span class="md-nav__icon md-icon"></span>
  325. </label>
  326. <nav class="md-nav" aria-label="Azure" data-md-level="2">
  327. <label class="md-nav__title" for="__nav_5_2">
  328. <span class="md-nav__icon md-icon"></span>
  329. Azure
  330. </label>
  331. <ul class="md-nav__list" data-md-scrollfix>
  332. <li class="md-nav__item">
  333. <a href="../provider-azure-key-vault/" class="md-nav__link">
  334. Key Vault
  335. </a>
  336. </li>
  337. </ul>
  338. </nav>
  339. </li>
  340. <li class="md-nav__item md-nav__item--nested">
  341. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_3" type="checkbox" id="__nav_5_3" >
  342. <label class="md-nav__link" for="__nav_5_3">
  343. Google
  344. <span class="md-nav__icon md-icon"></span>
  345. </label>
  346. <nav class="md-nav" aria-label="Google" data-md-level="2">
  347. <label class="md-nav__title" for="__nav_5_3">
  348. <span class="md-nav__icon md-icon"></span>
  349. Google
  350. </label>
  351. <ul class="md-nav__list" data-md-scrollfix>
  352. <li class="md-nav__item">
  353. <a href="../provider-google-secrets-manager/" class="md-nav__link">
  354. Secrets Manager
  355. </a>
  356. </li>
  357. </ul>
  358. </nav>
  359. </li>
  360. <li class="md-nav__item md-nav__item--nested">
  361. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_4" type="checkbox" id="__nav_5_4" >
  362. <label class="md-nav__link" for="__nav_5_4">
  363. IBM
  364. <span class="md-nav__icon md-icon"></span>
  365. </label>
  366. <nav class="md-nav" aria-label="IBM" data-md-level="2">
  367. <label class="md-nav__title" for="__nav_5_4">
  368. <span class="md-nav__icon md-icon"></span>
  369. IBM
  370. </label>
  371. <ul class="md-nav__list" data-md-scrollfix>
  372. <li class="md-nav__item">
  373. <a href="../provider-ibm-secrets-manager/" class="md-nav__link">
  374. Secrets Manager
  375. </a>
  376. </li>
  377. </ul>
  378. </nav>
  379. </li>
  380. <li class="md-nav__item">
  381. <a href="../provider-akeyless/" class="md-nav__link">
  382. Akeyless
  383. </a>
  384. </li>
  385. <li class="md-nav__item">
  386. <a href="../provider-hashicorp-vault/" class="md-nav__link">
  387. HashiCorp Vault
  388. </a>
  389. </li>
  390. <li class="md-nav__item md-nav__item--nested">
  391. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_7" type="checkbox" id="__nav_5_7" >
  392. <label class="md-nav__link" for="__nav_5_7">
  393. Yandex
  394. <span class="md-nav__icon md-icon"></span>
  395. </label>
  396. <nav class="md-nav" aria-label="Yandex" data-md-level="2">
  397. <label class="md-nav__title" for="__nav_5_7">
  398. <span class="md-nav__icon md-icon"></span>
  399. Yandex
  400. </label>
  401. <ul class="md-nav__list" data-md-scrollfix>
  402. <li class="md-nav__item">
  403. <a href="../provider-yandex-lockbox/" class="md-nav__link">
  404. Lockbox
  405. </a>
  406. </li>
  407. </ul>
  408. </nav>
  409. </li>
  410. <li class="md-nav__item md-nav__item--nested">
  411. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_8" type="checkbox" id="__nav_5_8" >
  412. <label class="md-nav__link" for="__nav_5_8">
  413. Gitlab
  414. <span class="md-nav__icon md-icon"></span>
  415. </label>
  416. <nav class="md-nav" aria-label="Gitlab" data-md-level="2">
  417. <label class="md-nav__title" for="__nav_5_8">
  418. <span class="md-nav__icon md-icon"></span>
  419. Gitlab
  420. </label>
  421. <ul class="md-nav__list" data-md-scrollfix>
  422. <li class="md-nav__item">
  423. <a href="../provider-gitlab-project-variables/" class="md-nav__link">
  424. Gitlab Project Variables
  425. </a>
  426. </li>
  427. </ul>
  428. </nav>
  429. </li>
  430. <li class="md-nav__item md-nav__item--nested">
  431. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_9" type="checkbox" id="__nav_5_9" >
  432. <label class="md-nav__link" for="__nav_5_9">
  433. Oracle
  434. <span class="md-nav__icon md-icon"></span>
  435. </label>
  436. <nav class="md-nav" aria-label="Oracle" data-md-level="2">
  437. <label class="md-nav__title" for="__nav_5_9">
  438. <span class="md-nav__icon md-icon"></span>
  439. Oracle
  440. </label>
  441. <ul class="md-nav__list" data-md-scrollfix>
  442. <li class="md-nav__item">
  443. <a href="../provider-oracle-vault/" class="md-nav__link">
  444. Oracle Vault
  445. </a>
  446. </li>
  447. </ul>
  448. </nav>
  449. </li>
  450. <li class="md-nav__item">
  451. <a href="../provider-webhook/" class="md-nav__link">
  452. Webhook
  453. </a>
  454. </li>
  455. </ul>
  456. </nav>
  457. </li>
  458. <li class="md-nav__item md-nav__item--nested">
  459. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6" type="checkbox" id="__nav_6" >
  460. <label class="md-nav__link" for="__nav_6">
  461. References
  462. <span class="md-nav__icon md-icon"></span>
  463. </label>
  464. <nav class="md-nav" aria-label="References" data-md-level="1">
  465. <label class="md-nav__title" for="__nav_6">
  466. <span class="md-nav__icon md-icon"></span>
  467. References
  468. </label>
  469. <ul class="md-nav__list" data-md-scrollfix>
  470. <li class="md-nav__item">
  471. <a href="../spec/" class="md-nav__link">
  472. API specification
  473. </a>
  474. </li>
  475. </ul>
  476. </nav>
  477. </li>
  478. <li class="md-nav__item md-nav__item--nested">
  479. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7" type="checkbox" id="__nav_7" >
  480. <label class="md-nav__link" for="__nav_7">
  481. Contributing
  482. <span class="md-nav__icon md-icon"></span>
  483. </label>
  484. <nav class="md-nav" aria-label="Contributing" data-md-level="1">
  485. <label class="md-nav__title" for="__nav_7">
  486. <span class="md-nav__icon md-icon"></span>
  487. Contributing
  488. </label>
  489. <ul class="md-nav__list" data-md-scrollfix>
  490. <li class="md-nav__item">
  491. <a href="../contributing-devguide/" class="md-nav__link">
  492. Developer guide
  493. </a>
  494. </li>
  495. <li class="md-nav__item">
  496. <a href="../contributing-process/" class="md-nav__link">
  497. Contributing Process
  498. </a>
  499. </li>
  500. <li class="md-nav__item">
  501. <a href="../contributing-coc/" class="md-nav__link">
  502. Code of Conduct
  503. </a>
  504. </li>
  505. </ul>
  506. </nav>
  507. </li>
  508. <li class="md-nav__item">
  509. <a href="../deprecation-policy/" class="md-nav__link">
  510. Deprecation Policy
  511. </a>
  512. </li>
  513. </ul>
  514. </nav>
  515. </div>
  516. </div>
  517. </div>
  518. <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
  519. <div class="md-sidebar__scrollwrap">
  520. <div class="md-sidebar__inner">
  521. <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  522. <label class="md-nav__title" for="__toc">
  523. <span class="md-nav__icon md-icon"></span>
  524. Table of contents
  525. </label>
  526. <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
  527. <li class="md-nav__item">
  528. <a href="#advantages" class="md-nav__link">
  529. Advantages
  530. </a>
  531. </li>
  532. <li class="md-nav__item">
  533. <a href="#the-approach" class="md-nav__link">
  534. The approach
  535. </a>
  536. </li>
  537. <li class="md-nav__item">
  538. <a href="#the-problem" class="md-nav__link">
  539. The problem
  540. </a>
  541. </li>
  542. <li class="md-nav__item">
  543. <a href="#the-solution" class="md-nav__link">
  544. The solution
  545. </a>
  546. </li>
  547. <li class="md-nav__item">
  548. <a href="#create-the-main-kustomization" class="md-nav__link">
  549. Create the main kustomization
  550. </a>
  551. </li>
  552. <li class="md-nav__item">
  553. <a href="#create-the-secret" class="md-nav__link">
  554. Create the secret
  555. </a>
  556. </li>
  557. <li class="md-nav__item">
  558. <a href="#creating-the-references-to-repositories" class="md-nav__link">
  559. Creating the references to repositories
  560. </a>
  561. </li>
  562. <li class="md-nav__item">
  563. <a href="#deploy-the-crds" class="md-nav__link">
  564. Deploy the CRDs
  565. </a>
  566. </li>
  567. <li class="md-nav__item">
  568. <a href="#deploy-the-operator" class="md-nav__link">
  569. Deploy the operator
  570. </a>
  571. </li>
  572. <li class="md-nav__item">
  573. <a href="#deploy-the-crs" class="md-nav__link">
  574. Deploy the CRs
  575. </a>
  576. </li>
  577. <li class="md-nav__item">
  578. <a href="#results" class="md-nav__link">
  579. Results
  580. </a>
  581. </li>
  582. </ul>
  583. </nav>
  584. </div>
  585. </div>
  586. </div>
  587. <div class="md-content" data-md-component="content">
  588. <article class="md-content__inner md-typeset">
  589. <a href="https://github.com/external-secrets/external-secrets/edit/master/docs/guides-gitops-using-fluxcd.md" title="Edit this page" class="md-content__button md-icon">
  590. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z"/></svg>
  591. </a>
  592. <h1 id="gitops-using-fluxcd-v2">GitOps using FluxCD (v2)</h1>
  593. <p>FluxCD is a GitOps operator for Kubernetes. It synchronizes the status of the cluster from manifests allocated in
  594. different repositories (Git or Helm). This approach fits perfectly with External Secrets on clusters which are dynamically
  595. created, to get credentials with no manual intervention from the beginning.</p>
  596. <h2 id="advantages">Advantages</h2>
  597. <p>This approach has several advantages as follows:</p>
  598. <ul>
  599. <li><strong>Homogenize environments</strong> allowing developers to use the same toolset in Kind in the same way they do in the cloud
  600. provider distributions such as EKS or GKE. This accelerates the development</li>
  601. <li><strong>Reduce security risks</strong>, because credentials can be easily obtained, so temptation to store them locally is reduced.</li>
  602. <li><strong>Application compatibility increase</strong>: Applications are deployed in different ways, and sometimes they need to share
  603. credentials. This can be done using External Secrets as a wire for them at real time.</li>
  604. <li><strong>Automation by default</strong> oh, come on!</li>
  605. </ul>
  606. <h2 id="the-approach">The approach</h2>
  607. <p>FluxCD is composed by several controllers dedicated to manage different custom resources. The most important
  608. ones are <strong>Kustomization</strong> (to clarify, Flux one, not Kubernetes' one) and <strong>HelmRelease</strong> to deploy using the approaches
  609. of the same names.</p>
  610. <p>External Secrets can be deployed using Helm <a href="../guides-getting-started/">as explained here</a>. The deployment includes the
  611. CRDs if enabled on the <code>values.yaml</code>, but after this, you need to deploy some <code>SecretStore</code> to start
  612. getting credentials from your secrets manager with External Secrets.</p>
  613. <blockquote>
  614. <p>The idea of this guide is to deploy the whole stack, using flux, needed by developers not to worry about the credentials,
  615. but only about the application and its code.</p>
  616. </blockquote>
  617. <h2 id="the-problem">The problem</h2>
  618. <p>This can sound easy, but External Secrets is deployed using Helm, which is managed by the HelmController,
  619. and your custom resources, for example a <code>ClusterSecretStore</code> and the related <code>Secret</code>, are often deployed using a
  620. <code>kustomization.yaml</code>, which is deployed by the KustomizeController.</p>
  621. <p>Both controllers manage the resources independently, at different moments, with no possibility to wait each other.
  622. This means that we have a wonderful race condition where sometimes the CRs (<code>SecretStore</code>,<code>ClusterSecretStore</code>...) tries
  623. to be deployed before than the CRDs needed to recognize them.</p>
  624. <h2 id="the-solution">The solution</h2>
  625. <p>Let's see the conditions to start working on a solution:</p>
  626. <ul>
  627. <li>The External Secrets operator is deployed with Helm, and admits disabling the CRDs deployment</li>
  628. <li>The race condition only affects the deployment of <code>CustomResourceDefinition</code> and the CRs needed later</li>
  629. <li>CRDs can be deployed directly from the Git repository of the project using a Flux <code>Kustomization</code></li>
  630. <li>Required CRs can be deployed using a Flux <code>Kustomization</code> too, allowing dependency between CRDs and CRs</li>
  631. <li>All previous manifests can be applied with a Kubernetes <code>kustomization</code></li>
  632. </ul>
  633. <h2 id="create-the-main-kustomization">Create the main kustomization</h2>
  634. <p>To have a better view of things needed later, the first manifest to be created is the <code>kustomization.yaml</code></p>
  635. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.config.k8s.io/v1beta1</span>
  636. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  637. <span class="nt">resources</span><span class="p">:</span>
  638. <span class="c1"># Deploy the Vault access secret</span>
  639. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">namespace.yaml</span>
  640. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">secret-token.yaml</span>
  641. <span class="c1"># Deploy the repositories</span>
  642. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">repositories.yaml</span>
  643. <span class="c1"># Deploy the CRDs</span>
  644. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment-crds.yaml</span>
  645. <span class="c1"># Deploy the operator</span>
  646. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment.yaml</span>
  647. <span class="c1"># Deploy default Custom Resources from &#39;crs&#39; directory</span>
  648. <span class="c1"># INFO: This depends on the CRDs deployment. Will happen after it</span>
  649. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment-crs.yaml</span>
  650. </code></pre></div>
  651. <h2 id="create-the-secret">Create the secret</h2>
  652. <p>To access your secret manager, External Secrets needs some credentials. They are stored inside a Secret, which is intended
  653. to be deployed by automation as a good practise. This time, a placeholder called <code>secret-token.yaml</code> is show as an example:</p>
  654. <div class="highlight"><pre><span></span><code><span class="c1"># The namespace.yaml first</span>
  655. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
  656. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Namespace</span>
  657. <span class="nt">metadata</span><span class="p">:</span>
  658. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  659. </code></pre></div>
  660. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
  661. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Secret</span>
  662. <span class="nt">metadata</span><span class="p">:</span>
  663. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">vault-token-global</span>
  664. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  665. <span class="nt">stringData</span><span class="p">:</span>
  666. <span class="c1"># This token must be patched by overlays. Not here for security reasons</span>
  667. <span class="nt">token</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">change-me-placeholder</span>
  668. </code></pre></div>
  669. <h2 id="creating-the-references-to-repositories">Creating the references to repositories</h2>
  670. <p>Create a manifest called <code>repositories.yaml</code> to store the references to external repositories for Flux</p>
  671. <div class="highlight"><pre><span></span><code><span class="c1"># Reference to Helm repository</span>
  672. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">source.toolkit.fluxcd.io/v1beta1</span>
  673. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRepository</span>
  674. <span class="nt">metadata</span><span class="p">:</span>
  675. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  676. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  677. <span class="nt">spec</span><span class="p">:</span>
  678. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  679. <span class="nt">url</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">https://charts.external-secrets.io</span>
  680. <span class="nn">---</span>
  681. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">source.toolkit.fluxcd.io/v1beta1</span>
  682. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  683. <span class="nt">metadata</span><span class="p">:</span>
  684. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  685. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  686. <span class="nt">spec</span><span class="p">:</span>
  687. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  688. <span class="nt">ref</span><span class="p">:</span>
  689. <span class="nt">branch</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">main</span>
  690. <span class="nt">url</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">http://github.com/external-secrets/external-secrets</span>
  691. </code></pre></div>
  692. <h2 id="deploy-the-crds">Deploy the CRDs</h2>
  693. <p>As mentioned, CRDs can be deployed using the official Helm package, but to solve the race condition, they will be deployed
  694. from our git repository using a Kustomization manifest called <code>deployment-crds.yaml</code> as follows:</p>
  695. <div class="highlight"><pre><span></span><code><span class="nn">---</span>
  696. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.toolkit.fluxcd.io/v1beta2</span>
  697. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  698. <span class="nt">metadata</span><span class="p">:</span>
  699. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crds</span>
  700. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  701. <span class="nt">spec</span><span class="p">:</span>
  702. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  703. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./deploy/crds</span>
  704. <span class="nt">prune</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  705. <span class="nt">sourceRef</span><span class="p">:</span>
  706. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  707. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  708. </code></pre></div>
  709. <h2 id="deploy-the-operator">Deploy the operator</h2>
  710. <p>The operator is deployed using a HelmRelease manifest to deploy the Helm package, but due to the special race condition,
  711. the deployment must be disabled in the <code>values</code> of the manifest called <code>deployment.yaml</code>, as follows:</p>
  712. <div class="highlight"><pre><span></span><code><span class="c1"># How to manage values files. Ref: https://fluxcd.io/docs/guides/helmreleases/#refer-to-values-inside-the-chart</span>
  713. <span class="c1"># How to inject values: https://fluxcd.io/docs/guides/helmreleases/#cloud-storage</span>
  714. <span class="nn">---</span>
  715. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">helm.toolkit.fluxcd.io/v2beta1</span>
  716. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRelease</span>
  717. <span class="nt">metadata</span><span class="p">:</span>
  718. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  719. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  720. <span class="nt">spec</span><span class="p">:</span>
  721. <span class="c1"># Override Release name to avoid the pattern Namespace-Release</span>
  722. <span class="c1"># Ref: https://fluxcd.io/docs/components/helm/api/#helm.toolkit.fluxcd.io/v2beta1.HelmRelease</span>
  723. <span class="nt">releaseName</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  724. <span class="nt">targetNamespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  725. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  726. <span class="nt">chart</span><span class="p">:</span>
  727. <span class="nt">spec</span><span class="p">:</span>
  728. <span class="nt">chart</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  729. <span class="nt">version</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">0.3.9</span>
  730. <span class="nt">sourceRef</span><span class="p">:</span>
  731. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRepository</span>
  732. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  733. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  734. <span class="nt">values</span><span class="p">:</span>
  735. <span class="nt">installCRDs</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">false</span>
  736. <span class="c1"># Ref: https://fluxcd.io/docs/components/helm/api/#helm.toolkit.fluxcd.io/v2beta1.Install</span>
  737. <span class="nt">install</span><span class="p">:</span>
  738. <span class="nt">createNamespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  739. </code></pre></div>
  740. <h2 id="deploy-the-crs">Deploy the CRs</h2>
  741. <p>Now, be ready for the arcane magic. Create a Kustomization manifest called <code>deployment-crs.yaml</code> with the following content:</p>
  742. <div class="highlight"><pre><span></span><code><span class="nn">---</span>
  743. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.toolkit.fluxcd.io/v1beta2</span>
  744. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  745. <span class="nt">metadata</span><span class="p">:</span>
  746. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crs</span>
  747. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  748. <span class="nt">spec</span><span class="p">:</span>
  749. <span class="nt">dependsOn</span><span class="p">:</span>
  750. <span class="p p-Indicator">-</span> <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crds</span>
  751. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  752. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./infrastructure/external-secrets/crs</span>
  753. <span class="nt">prune</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  754. <span class="nt">sourceRef</span><span class="p">:</span>
  755. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  756. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  757. </code></pre></div>
  758. <p>There are several interesting details to see here, that finally solves the race condition:</p>
  759. <ol>
  760. <li>First one is the field <code>dependsOn</code>, which points to a previous Kustomization called <code>external-secrets-crds</code>. This
  761. dependency forces this deployment to wait for the other to be ready, before start being deployed.</li>
  762. <li>The reference to the place where to find the CRs
  763. <div class="highlight"><pre><span></span><code><span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./infrastructure/external-secrets/crs</span>
  764. <span class="nt">sourceRef</span><span class="p">:</span>
  765. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  766. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  767. </code></pre></div>
  768. Custom Resources will be searched in the relative path <code>./infrastructure/external-secrets/crs</code> of the GitRepository
  769. called <code>flux-system</code>, which is a reference to the same repository that FluxCD watches to synchronize the cluster.
  770. With fewer words, a reference to itself, but going to another directory called <code>crs</code></li>
  771. </ol>
  772. <p>Of course, allocate inside the mentioned path <code>./infrastructure/external-secrets/crs</code>, all the desired CRs to be deployed,
  773. for example, a manifest <code>clusterSecretStore.yaml</code> to reach your Hashicorp Vault as follows:</p>
  774. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1alpha1</span>
  775. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">ClusterSecretStore</span>
  776. <span class="nt">metadata</span><span class="p">:</span>
  777. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">vault-backend-global</span>
  778. <span class="nt">spec</span><span class="p">:</span>
  779. <span class="nt">provider</span><span class="p">:</span>
  780. <span class="nt">vault</span><span class="p">:</span>
  781. <span class="nt">server</span><span class="p">:</span> <span class="s">&quot;https://vault.your-domain.com&quot;</span>
  782. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">secret</span>
  783. <span class="nt">version</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v2</span>
  784. <span class="nt">auth</span><span class="p">:</span>
  785. <span class="c1"># points to a secret that contains a vault token</span>
  786. <span class="c1"># https://www.vaultproject.io/docs/auth/token</span>
  787. <span class="nt">tokenSecretRef</span><span class="p">:</span>
  788. <span class="nt">name</span><span class="p">:</span> <span class="s">&quot;vault-token-global&quot;</span>
  789. <span class="nt">key</span><span class="p">:</span> <span class="s">&quot;token&quot;</span>
  790. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  791. </code></pre></div>
  792. <h2 id="results">Results</h2>
  793. <p>At the end, the required files tree is shown in the following picture:</p>
  794. <p><img alt="FluxCD files tree" src="../pictures/screenshot_gitops_final_directory_tree.png" /></p>
  795. </article>
  796. </div>
  797. </div>
  798. </main>
  799. <footer class="md-footer">
  800. <nav class="md-footer__inner md-grid" aria-label="Footer">
  801. <a href="../guides-using-latest-image/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Using Latest Image" rel="prev">
  802. <div class="md-footer__button md-icon">
  803. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
  804. </div>
  805. <div class="md-footer__title">
  806. <div class="md-ellipsis">
  807. <span class="md-footer__direction">
  808. Previous
  809. </span>
  810. Using Latest Image
  811. </div>
  812. </div>
  813. </a>
  814. <a href="../provider-aws-secrets-manager/" class="md-footer__link md-footer__link--next" aria-label="Next: Secrets Manager" rel="next">
  815. <div class="md-footer__title">
  816. <div class="md-ellipsis">
  817. <span class="md-footer__direction">
  818. Next
  819. </span>
  820. Secrets Manager
  821. </div>
  822. </div>
  823. <div class="md-footer__button md-icon">
  824. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg>
  825. </div>
  826. </a>
  827. </nav>
  828. <div class="md-footer-meta md-typeset">
  829. <div class="md-footer-meta__inner md-grid">
  830. <div class="md-footer-copyright">
  831. Made with
  832. <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
  833. Material for MkDocs
  834. </a>
  835. </div>
  836. </div>
  837. </div>
  838. </footer>
  839. </div>
  840. <div class="md-dialog" data-md-component="dialog">
  841. <div class="md-dialog__inner md-typeset"></div>
  842. </div>
  843. <script id="__config" type="application/json">{"base": "..", "features": [], "translations": {"clipboard.copy": "Copy to clipboard", "clipboard.copied": "Copied to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.placeholder": "Type to start searching", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "search": "../assets/javascripts/workers/search.b0710199.min.js", "version": null}</script>
  844. <script src="../assets/javascripts/bundle.76f349be.min.js"></script>
  845. </body>
  846. </html>