index.html 47 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448
  1. <!doctype html>
  2. <html lang="en" class="no-js">
  3. <head>
  4. <meta charset="utf-8">
  5. <meta name="viewport" content="width=device-width,initial-scale=1">
  6. <link rel="icon" href="../assets/images/favicon.png">
  7. <meta name="generator" content="mkdocs-1.1, mkdocs-material-7.1.8">
  8. <title>GitOps using FluxCD - External Secrets Operator</title>
  9. <link rel="stylesheet" href="../assets/stylesheets/main.ca7ac06f.min.css">
  10. <link rel="stylesheet" href="../assets/stylesheets/palette.f1a3b89f.min.css">
  11. <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  12. <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700%7CRoboto+Mono&display=fallback">
  13. <style>:root{--md-text-font-family:"Roboto";--md-code-font-family:"Roboto Mono"}</style>
  14. <script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",function(){"undefined"!=typeof location$&&location$.subscribe(function(t){gtag("config","G-QP38TD8K7V",{page_path:t.pathname})})})</script>
  15. <script async src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V"></script>
  16. </head>
  17. <body dir="ltr" data-md-color-scheme="" data-md-color-primary="none" data-md-color-accent="none">
  18. <script>function __prefix(e){return new URL("..",location).pathname+"."+e}function __get(e,t=localStorage){return JSON.parse(t.getItem(__prefix(e)))}</script>
  19. <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
  20. <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
  21. <label class="md-overlay" for="__drawer"></label>
  22. <div data-md-component="skip">
  23. <a href="#gitops-using-fluxcd-v2" class="md-skip">
  24. Skip to content
  25. </a>
  26. </div>
  27. <div data-md-component="announce">
  28. </div>
  29. <header class="md-header" data-md-component="header">
  30. <nav class="md-header__inner md-grid" aria-label="Header">
  31. <a href=".." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
  32. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54z"/></svg>
  33. </a>
  34. <label class="md-header__button md-icon" for="__drawer">
  35. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
  36. </label>
  37. <div class="md-header__title" data-md-component="header-title">
  38. <div class="md-header__ellipsis">
  39. <div class="md-header__topic">
  40. <span class="md-ellipsis">
  41. External Secrets Operator
  42. </span>
  43. </div>
  44. <div class="md-header__topic" data-md-component="header-topic">
  45. <span class="md-ellipsis">
  46. GitOps using FluxCD
  47. </span>
  48. </div>
  49. </div>
  50. </div>
  51. <label class="md-header__button md-icon" for="__search">
  52. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
  53. </label>
  54. <div class="md-search" data-md-component="search" role="dialog">
  55. <label class="md-search__overlay" for="__search"></label>
  56. <div class="md-search__inner" role="search">
  57. <form class="md-search__form" name="search">
  58. <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" data-md-state="active" required>
  59. <label class="md-search__icon md-icon" for="__search">
  60. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
  61. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
  62. </label>
  63. <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
  64. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
  65. </button>
  66. </form>
  67. <div class="md-search__output">
  68. <div class="md-search__scrollwrap" data-md-scrollfix>
  69. <div class="md-search-result" data-md-component="search-result">
  70. <div class="md-search-result__meta">
  71. Initializing search
  72. </div>
  73. <ol class="md-search-result__list"></ol>
  74. </div>
  75. </div>
  76. </div>
  77. </div>
  78. </div>
  79. <div class="md-header__source">
  80. <a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-component="source">
  81. <div class="md-source__icon md-icon">
  82. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  83. </div>
  84. <div class="md-source__repository">
  85. External Secrets Operator
  86. </div>
  87. </a>
  88. </div>
  89. </nav>
  90. </header>
  91. <div class="md-container" data-md-component="container">
  92. <main class="md-main" data-md-component="main">
  93. <div class="md-main__inner md-grid">
  94. <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
  95. <div class="md-sidebar__scrollwrap">
  96. <div class="md-sidebar__inner">
  97. <nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
  98. <label class="md-nav__title" for="__drawer">
  99. <a href=".." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
  100. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54z"/></svg>
  101. </a>
  102. External Secrets Operator
  103. </label>
  104. <div class="md-nav__source">
  105. <a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-component="source">
  106. <div class="md-source__icon md-icon">
  107. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  108. </div>
  109. <div class="md-source__repository">
  110. External Secrets Operator
  111. </div>
  112. </a>
  113. </div>
  114. <ul class="md-nav__list" data-md-scrollfix>
  115. <li class="md-nav__item">
  116. <a href=".." class="md-nav__link">
  117. Introduction
  118. </a>
  119. </li>
  120. <li class="md-nav__item">
  121. <a href="../api-overview/" class="md-nav__link">
  122. Overview
  123. </a>
  124. </li>
  125. <li class="md-nav__item md-nav__item--nested">
  126. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3" type="checkbox" id="__nav_3" >
  127. <label class="md-nav__link" for="__nav_3">
  128. API Types
  129. <span class="md-nav__icon md-icon"></span>
  130. </label>
  131. <nav class="md-nav" aria-label="API Types" data-md-level="1">
  132. <label class="md-nav__title" for="__nav_3">
  133. <span class="md-nav__icon md-icon"></span>
  134. API Types
  135. </label>
  136. <ul class="md-nav__list" data-md-scrollfix>
  137. <li class="md-nav__item">
  138. <a href="../api-externalsecret/" class="md-nav__link">
  139. ExternalSecret
  140. </a>
  141. </li>
  142. <li class="md-nav__item">
  143. <a href="../api-secretstore/" class="md-nav__link">
  144. SecretStore
  145. </a>
  146. </li>
  147. <li class="md-nav__item">
  148. <a href="../api-clustersecretstore/" class="md-nav__link">
  149. ClusterSecretStore
  150. </a>
  151. </li>
  152. </ul>
  153. </nav>
  154. </li>
  155. <li class="md-nav__item md-nav__item--active md-nav__item--nested">
  156. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4" type="checkbox" id="__nav_4" checked>
  157. <label class="md-nav__link" for="__nav_4">
  158. Guides
  159. <span class="md-nav__icon md-icon"></span>
  160. </label>
  161. <nav class="md-nav" aria-label="Guides" data-md-level="1">
  162. <label class="md-nav__title" for="__nav_4">
  163. <span class="md-nav__icon md-icon"></span>
  164. Guides
  165. </label>
  166. <ul class="md-nav__list" data-md-scrollfix>
  167. <li class="md-nav__item">
  168. <a href="../guides-introduction/" class="md-nav__link">
  169. Introduction
  170. </a>
  171. </li>
  172. <li class="md-nav__item">
  173. <a href="../guides-getting-started/" class="md-nav__link">
  174. Getting started
  175. </a>
  176. </li>
  177. <li class="md-nav__item">
  178. <a href="../guides-templating/" class="md-nav__link">
  179. Advanced Templating
  180. </a>
  181. </li>
  182. <li class="md-nav__item">
  183. <a href="../guides-controller-class/" class="md-nav__link">
  184. Controller Classes
  185. </a>
  186. </li>
  187. <li class="md-nav__item">
  188. <a href="../guides-all-keys-one-secret/" class="md-nav__link">
  189. All keys, One secret
  190. </a>
  191. </li>
  192. <li class="md-nav__item">
  193. <a href="../guides-common-k8s-secret-types/" class="md-nav__link">
  194. Common K8S Secret Types
  195. </a>
  196. </li>
  197. <li class="md-nav__item">
  198. <a href="../guides-multi-tenancy/" class="md-nav__link">
  199. Multi Tenancy
  200. </a>
  201. </li>
  202. <li class="md-nav__item">
  203. <a href="../guides-metrics/" class="md-nav__link">
  204. Metrics
  205. </a>
  206. </li>
  207. <li class="md-nav__item">
  208. <a href="../guides-using-latest-image/" class="md-nav__link">
  209. Using Latest Image
  210. </a>
  211. </li>
  212. <li class="md-nav__item md-nav__item--active">
  213. <input class="md-nav__toggle md-toggle" data-md-toggle="toc" type="checkbox" id="__toc">
  214. <label class="md-nav__link md-nav__link--active" for="__toc">
  215. GitOps using FluxCD
  216. <span class="md-nav__icon md-icon"></span>
  217. </label>
  218. <a href="./" class="md-nav__link md-nav__link--active">
  219. GitOps using FluxCD
  220. </a>
  221. <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  222. <label class="md-nav__title" for="__toc">
  223. <span class="md-nav__icon md-icon"></span>
  224. Table of contents
  225. </label>
  226. <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
  227. <li class="md-nav__item">
  228. <a href="#advantages" class="md-nav__link">
  229. Advantages
  230. </a>
  231. </li>
  232. <li class="md-nav__item">
  233. <a href="#the-approach" class="md-nav__link">
  234. The approach
  235. </a>
  236. </li>
  237. <li class="md-nav__item">
  238. <a href="#the-problem" class="md-nav__link">
  239. The problem
  240. </a>
  241. </li>
  242. <li class="md-nav__item">
  243. <a href="#the-solution" class="md-nav__link">
  244. The solution
  245. </a>
  246. </li>
  247. <li class="md-nav__item">
  248. <a href="#create-the-main-kustomization" class="md-nav__link">
  249. Create the main kustomization
  250. </a>
  251. </li>
  252. <li class="md-nav__item">
  253. <a href="#create-the-secret" class="md-nav__link">
  254. Create the secret
  255. </a>
  256. </li>
  257. <li class="md-nav__item">
  258. <a href="#creating-the-references-to-repositories" class="md-nav__link">
  259. Creating the references to repositories
  260. </a>
  261. </li>
  262. <li class="md-nav__item">
  263. <a href="#deploy-the-crds" class="md-nav__link">
  264. Deploy the CRDs
  265. </a>
  266. </li>
  267. <li class="md-nav__item">
  268. <a href="#deploy-the-operator" class="md-nav__link">
  269. Deploy the operator
  270. </a>
  271. </li>
  272. <li class="md-nav__item">
  273. <a href="#deploy-the-crs" class="md-nav__link">
  274. Deploy the CRs
  275. </a>
  276. </li>
  277. <li class="md-nav__item">
  278. <a href="#results" class="md-nav__link">
  279. Results
  280. </a>
  281. </li>
  282. </ul>
  283. </nav>
  284. </li>
  285. </ul>
  286. </nav>
  287. </li>
  288. <li class="md-nav__item md-nav__item--nested">
  289. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5" type="checkbox" id="__nav_5" >
  290. <label class="md-nav__link" for="__nav_5">
  291. Provider
  292. <span class="md-nav__icon md-icon"></span>
  293. </label>
  294. <nav class="md-nav" aria-label="Provider" data-md-level="1">
  295. <label class="md-nav__title" for="__nav_5">
  296. <span class="md-nav__icon md-icon"></span>
  297. Provider
  298. </label>
  299. <ul class="md-nav__list" data-md-scrollfix>
  300. <li class="md-nav__item md-nav__item--nested">
  301. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_1" type="checkbox" id="__nav_5_1" >
  302. <label class="md-nav__link" for="__nav_5_1">
  303. AWS
  304. <span class="md-nav__icon md-icon"></span>
  305. </label>
  306. <nav class="md-nav" aria-label="AWS" data-md-level="2">
  307. <label class="md-nav__title" for="__nav_5_1">
  308. <span class="md-nav__icon md-icon"></span>
  309. AWS
  310. </label>
  311. <ul class="md-nav__list" data-md-scrollfix>
  312. <li class="md-nav__item">
  313. <a href="../provider-aws-secrets-manager/" class="md-nav__link">
  314. Secrets Manager
  315. </a>
  316. </li>
  317. <li class="md-nav__item">
  318. <a href="../provider-aws-parameter-store/" class="md-nav__link">
  319. Parameter Store
  320. </a>
  321. </li>
  322. </ul>
  323. </nav>
  324. </li>
  325. <li class="md-nav__item md-nav__item--nested">
  326. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_2" type="checkbox" id="__nav_5_2" >
  327. <label class="md-nav__link" for="__nav_5_2">
  328. Azure
  329. <span class="md-nav__icon md-icon"></span>
  330. </label>
  331. <nav class="md-nav" aria-label="Azure" data-md-level="2">
  332. <label class="md-nav__title" for="__nav_5_2">
  333. <span class="md-nav__icon md-icon"></span>
  334. Azure
  335. </label>
  336. <ul class="md-nav__list" data-md-scrollfix>
  337. <li class="md-nav__item">
  338. <a href="../provider-azure-key-vault/" class="md-nav__link">
  339. Key Vault
  340. </a>
  341. </li>
  342. </ul>
  343. </nav>
  344. </li>
  345. <li class="md-nav__item md-nav__item--nested">
  346. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_3" type="checkbox" id="__nav_5_3" >
  347. <label class="md-nav__link" for="__nav_5_3">
  348. Google
  349. <span class="md-nav__icon md-icon"></span>
  350. </label>
  351. <nav class="md-nav" aria-label="Google" data-md-level="2">
  352. <label class="md-nav__title" for="__nav_5_3">
  353. <span class="md-nav__icon md-icon"></span>
  354. Google
  355. </label>
  356. <ul class="md-nav__list" data-md-scrollfix>
  357. <li class="md-nav__item">
  358. <a href="../provider-google-secrets-manager/" class="md-nav__link">
  359. Secrets Manager
  360. </a>
  361. </li>
  362. </ul>
  363. </nav>
  364. </li>
  365. <li class="md-nav__item md-nav__item--nested">
  366. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_4" type="checkbox" id="__nav_5_4" >
  367. <label class="md-nav__link" for="__nav_5_4">
  368. IBM
  369. <span class="md-nav__icon md-icon"></span>
  370. </label>
  371. <nav class="md-nav" aria-label="IBM" data-md-level="2">
  372. <label class="md-nav__title" for="__nav_5_4">
  373. <span class="md-nav__icon md-icon"></span>
  374. IBM
  375. </label>
  376. <ul class="md-nav__list" data-md-scrollfix>
  377. <li class="md-nav__item">
  378. <a href="../provider-ibm-secrets-manager/" class="md-nav__link">
  379. Secrets Manager
  380. </a>
  381. </li>
  382. </ul>
  383. </nav>
  384. </li>
  385. <li class="md-nav__item">
  386. <a href="../provider-akeyless/" class="md-nav__link">
  387. Akeyless
  388. </a>
  389. </li>
  390. <li class="md-nav__item">
  391. <a href="../provider-hashicorp-vault/" class="md-nav__link">
  392. HashiCorp Vault
  393. </a>
  394. </li>
  395. <li class="md-nav__item md-nav__item--nested">
  396. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_7" type="checkbox" id="__nav_5_7" >
  397. <label class="md-nav__link" for="__nav_5_7">
  398. Yandex
  399. <span class="md-nav__icon md-icon"></span>
  400. </label>
  401. <nav class="md-nav" aria-label="Yandex" data-md-level="2">
  402. <label class="md-nav__title" for="__nav_5_7">
  403. <span class="md-nav__icon md-icon"></span>
  404. Yandex
  405. </label>
  406. <ul class="md-nav__list" data-md-scrollfix>
  407. <li class="md-nav__item">
  408. <a href="../provider-yandex-lockbox/" class="md-nav__link">
  409. Lockbox
  410. </a>
  411. </li>
  412. </ul>
  413. </nav>
  414. </li>
  415. <li class="md-nav__item md-nav__item--nested">
  416. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_8" type="checkbox" id="__nav_5_8" >
  417. <label class="md-nav__link" for="__nav_5_8">
  418. Gitlab
  419. <span class="md-nav__icon md-icon"></span>
  420. </label>
  421. <nav class="md-nav" aria-label="Gitlab" data-md-level="2">
  422. <label class="md-nav__title" for="__nav_5_8">
  423. <span class="md-nav__icon md-icon"></span>
  424. Gitlab
  425. </label>
  426. <ul class="md-nav__list" data-md-scrollfix>
  427. <li class="md-nav__item">
  428. <a href="../provider-gitlab-project-variables/" class="md-nav__link">
  429. Gitlab Project Variables
  430. </a>
  431. </li>
  432. </ul>
  433. </nav>
  434. </li>
  435. <li class="md-nav__item md-nav__item--nested">
  436. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_9" type="checkbox" id="__nav_5_9" >
  437. <label class="md-nav__link" for="__nav_5_9">
  438. Oracle
  439. <span class="md-nav__icon md-icon"></span>
  440. </label>
  441. <nav class="md-nav" aria-label="Oracle" data-md-level="2">
  442. <label class="md-nav__title" for="__nav_5_9">
  443. <span class="md-nav__icon md-icon"></span>
  444. Oracle
  445. </label>
  446. <ul class="md-nav__list" data-md-scrollfix>
  447. <li class="md-nav__item">
  448. <a href="../provider-oracle-vault/" class="md-nav__link">
  449. Oracle Vault
  450. </a>
  451. </li>
  452. </ul>
  453. </nav>
  454. </li>
  455. <li class="md-nav__item">
  456. <a href="../provider-webhook/" class="md-nav__link">
  457. Webhook
  458. </a>
  459. </li>
  460. </ul>
  461. </nav>
  462. </li>
  463. <li class="md-nav__item md-nav__item--nested">
  464. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6" type="checkbox" id="__nav_6" >
  465. <label class="md-nav__link" for="__nav_6">
  466. References
  467. <span class="md-nav__icon md-icon"></span>
  468. </label>
  469. <nav class="md-nav" aria-label="References" data-md-level="1">
  470. <label class="md-nav__title" for="__nav_6">
  471. <span class="md-nav__icon md-icon"></span>
  472. References
  473. </label>
  474. <ul class="md-nav__list" data-md-scrollfix>
  475. <li class="md-nav__item">
  476. <a href="../spec/" class="md-nav__link">
  477. API specification
  478. </a>
  479. </li>
  480. </ul>
  481. </nav>
  482. </li>
  483. <li class="md-nav__item md-nav__item--nested">
  484. <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7" type="checkbox" id="__nav_7" >
  485. <label class="md-nav__link" for="__nav_7">
  486. Contributing
  487. <span class="md-nav__icon md-icon"></span>
  488. </label>
  489. <nav class="md-nav" aria-label="Contributing" data-md-level="1">
  490. <label class="md-nav__title" for="__nav_7">
  491. <span class="md-nav__icon md-icon"></span>
  492. Contributing
  493. </label>
  494. <ul class="md-nav__list" data-md-scrollfix>
  495. <li class="md-nav__item">
  496. <a href="../contributing-devguide/" class="md-nav__link">
  497. Developer guide
  498. </a>
  499. </li>
  500. <li class="md-nav__item">
  501. <a href="../contributing-process/" class="md-nav__link">
  502. Contributing Process
  503. </a>
  504. </li>
  505. <li class="md-nav__item">
  506. <a href="../contributing-coc/" class="md-nav__link">
  507. Code of Conduct
  508. </a>
  509. </li>
  510. </ul>
  511. </nav>
  512. </li>
  513. <li class="md-nav__item">
  514. <a href="../deprecation-policy/" class="md-nav__link">
  515. Deprecation Policy
  516. </a>
  517. </li>
  518. </ul>
  519. </nav>
  520. </div>
  521. </div>
  522. </div>
  523. <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
  524. <div class="md-sidebar__scrollwrap">
  525. <div class="md-sidebar__inner">
  526. <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  527. <label class="md-nav__title" for="__toc">
  528. <span class="md-nav__icon md-icon"></span>
  529. Table of contents
  530. </label>
  531. <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
  532. <li class="md-nav__item">
  533. <a href="#advantages" class="md-nav__link">
  534. Advantages
  535. </a>
  536. </li>
  537. <li class="md-nav__item">
  538. <a href="#the-approach" class="md-nav__link">
  539. The approach
  540. </a>
  541. </li>
  542. <li class="md-nav__item">
  543. <a href="#the-problem" class="md-nav__link">
  544. The problem
  545. </a>
  546. </li>
  547. <li class="md-nav__item">
  548. <a href="#the-solution" class="md-nav__link">
  549. The solution
  550. </a>
  551. </li>
  552. <li class="md-nav__item">
  553. <a href="#create-the-main-kustomization" class="md-nav__link">
  554. Create the main kustomization
  555. </a>
  556. </li>
  557. <li class="md-nav__item">
  558. <a href="#create-the-secret" class="md-nav__link">
  559. Create the secret
  560. </a>
  561. </li>
  562. <li class="md-nav__item">
  563. <a href="#creating-the-references-to-repositories" class="md-nav__link">
  564. Creating the references to repositories
  565. </a>
  566. </li>
  567. <li class="md-nav__item">
  568. <a href="#deploy-the-crds" class="md-nav__link">
  569. Deploy the CRDs
  570. </a>
  571. </li>
  572. <li class="md-nav__item">
  573. <a href="#deploy-the-operator" class="md-nav__link">
  574. Deploy the operator
  575. </a>
  576. </li>
  577. <li class="md-nav__item">
  578. <a href="#deploy-the-crs" class="md-nav__link">
  579. Deploy the CRs
  580. </a>
  581. </li>
  582. <li class="md-nav__item">
  583. <a href="#results" class="md-nav__link">
  584. Results
  585. </a>
  586. </li>
  587. </ul>
  588. </nav>
  589. </div>
  590. </div>
  591. </div>
  592. <div class="md-content" data-md-component="content">
  593. <article class="md-content__inner md-typeset">
  594. <a href="https://github.com/external-secrets/external-secrets/edit/master/docs/guides-gitops-using-fluxcd.md" title="Edit this page" class="md-content__button md-icon">
  595. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z"/></svg>
  596. </a>
  597. <h1 id="gitops-using-fluxcd-v2">GitOps using FluxCD (v2)</h1>
  598. <p>FluxCD is a GitOps operator for Kubernetes. It synchronizes the status of the cluster from manifests allocated in
  599. different repositories (Git or Helm). This approach fits perfectly with External Secrets on clusters which are dynamically
  600. created, to get credentials with no manual intervention from the beginning.</p>
  601. <h2 id="advantages">Advantages</h2>
  602. <p>This approach has several advantages as follows:</p>
  603. <ul>
  604. <li><strong>Homogenize environments</strong> allowing developers to use the same toolset in Kind in the same way they do in the cloud
  605. provider distributions such as EKS or GKE. This accelerates the development</li>
  606. <li><strong>Reduce security risks</strong>, because credentials can be easily obtained, so temptation to store them locally is reduced.</li>
  607. <li><strong>Application compatibility increase</strong>: Applications are deployed in different ways, and sometimes they need to share
  608. credentials. This can be done using External Secrets as a wire for them at real time.</li>
  609. <li><strong>Automation by default</strong> oh, come on!</li>
  610. </ul>
  611. <h2 id="the-approach">The approach</h2>
  612. <p>FluxCD is composed by several controllers dedicated to manage different custom resources. The most important
  613. ones are <strong>Kustomization</strong> (to clarify, Flux one, not Kubernetes' one) and <strong>HelmRelease</strong> to deploy using the approaches
  614. of the same names.</p>
  615. <p>External Secrets can be deployed using Helm <a href="../guides-getting-started/">as explained here</a>. The deployment includes the
  616. CRDs if enabled on the <code>values.yaml</code>, but after this, you need to deploy some <code>SecretStore</code> to start
  617. getting credentials from your secrets manager with External Secrets.</p>
  618. <blockquote>
  619. <p>The idea of this guide is to deploy the whole stack, using flux, needed by developers not to worry about the credentials,
  620. but only about the application and its code.</p>
  621. </blockquote>
  622. <h2 id="the-problem">The problem</h2>
  623. <p>This can sound easy, but External Secrets is deployed using Helm, which is managed by the HelmController,
  624. and your custom resources, for example a <code>ClusterSecretStore</code> and the related <code>Secret</code>, are often deployed using a
  625. <code>kustomization.yaml</code>, which is deployed by the KustomizeController.</p>
  626. <p>Both controllers manage the resources independently, at different moments, with no possibility to wait each other.
  627. This means that we have a wonderful race condition where sometimes the CRs (<code>SecretStore</code>,<code>ClusterSecretStore</code>...) tries
  628. to be deployed before than the CRDs needed to recognize them.</p>
  629. <h2 id="the-solution">The solution</h2>
  630. <p>Let's see the conditions to start working on a solution:</p>
  631. <ul>
  632. <li>The External Secrets operator is deployed with Helm, and admits disabling the CRDs deployment</li>
  633. <li>The race condition only affects the deployment of <code>CustomResourceDefinition</code> and the CRs needed later</li>
  634. <li>CRDs can be deployed directly from the Git repository of the project using a Flux <code>Kustomization</code></li>
  635. <li>Required CRs can be deployed using a Flux <code>Kustomization</code> too, allowing dependency between CRDs and CRs</li>
  636. <li>All previous manifests can be applied with a Kubernetes <code>kustomization</code></li>
  637. </ul>
  638. <h2 id="create-the-main-kustomization">Create the main kustomization</h2>
  639. <p>To have a better view of things needed later, the first manifest to be created is the <code>kustomization.yaml</code></p>
  640. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.config.k8s.io/v1beta1</span>
  641. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  642. <span class="nt">resources</span><span class="p">:</span>
  643. <span class="c1"># Deploy the Vault access secret</span>
  644. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">namespace.yaml</span>
  645. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">secret-token.yaml</span>
  646. <span class="c1"># Deploy the repositories</span>
  647. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">repositories.yaml</span>
  648. <span class="c1"># Deploy the CRDs</span>
  649. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment-crds.yaml</span>
  650. <span class="c1"># Deploy the operator</span>
  651. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment.yaml</span>
  652. <span class="c1"># Deploy default Custom Resources from &#39;crs&#39; directory</span>
  653. <span class="c1"># INFO: This depends on the CRDs deployment. Will happen after it</span>
  654. <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">deployment-crs.yaml</span>
  655. </code></pre></div>
  656. <h2 id="create-the-secret">Create the secret</h2>
  657. <p>To access your secret manager, External Secrets needs some credentials. They are stored inside a Secret, which is intended
  658. to be deployed by automation as a good practise. This time, a placeholder called <code>secret-token.yaml</code> is show as an example:</p>
  659. <div class="highlight"><pre><span></span><code><span class="c1"># The namespace.yaml first</span>
  660. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
  661. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Namespace</span>
  662. <span class="nt">metadata</span><span class="p">:</span>
  663. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  664. </code></pre></div>
  665. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
  666. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Secret</span>
  667. <span class="nt">metadata</span><span class="p">:</span>
  668. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">vault-token-global</span>
  669. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  670. <span class="nt">stringData</span><span class="p">:</span>
  671. <span class="c1"># This token must be patched by overlays. Not here for security reasons</span>
  672. <span class="nt">token</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">change-me-placeholder</span>
  673. </code></pre></div>
  674. <h2 id="creating-the-references-to-repositories">Creating the references to repositories</h2>
  675. <p>Create a manifest called <code>repositories.yaml</code> to store the references to external repositories for Flux</p>
  676. <div class="highlight"><pre><span></span><code><span class="c1"># Reference to Helm repository</span>
  677. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">source.toolkit.fluxcd.io/v1beta1</span>
  678. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRepository</span>
  679. <span class="nt">metadata</span><span class="p">:</span>
  680. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  681. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  682. <span class="nt">spec</span><span class="p">:</span>
  683. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  684. <span class="nt">url</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">https://charts.external-secrets.io</span>
  685. <span class="nn">---</span>
  686. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">source.toolkit.fluxcd.io/v1beta1</span>
  687. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  688. <span class="nt">metadata</span><span class="p">:</span>
  689. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  690. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  691. <span class="nt">spec</span><span class="p">:</span>
  692. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  693. <span class="nt">ref</span><span class="p">:</span>
  694. <span class="nt">branch</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">main</span>
  695. <span class="nt">url</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">http://github.com/external-secrets/external-secrets</span>
  696. </code></pre></div>
  697. <h2 id="deploy-the-crds">Deploy the CRDs</h2>
  698. <p>As mentioned, CRDs can be deployed using the official Helm package, but to solve the race condition, they will be deployed
  699. from our git repository using a Kustomization manifest called <code>deployment-crds.yaml</code> as follows:</p>
  700. <div class="highlight"><pre><span></span><code><span class="nn">---</span>
  701. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.toolkit.fluxcd.io/v1beta2</span>
  702. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  703. <span class="nt">metadata</span><span class="p">:</span>
  704. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crds</span>
  705. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  706. <span class="nt">spec</span><span class="p">:</span>
  707. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  708. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./deploy/crds</span>
  709. <span class="nt">prune</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  710. <span class="nt">sourceRef</span><span class="p">:</span>
  711. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  712. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  713. </code></pre></div>
  714. <h2 id="deploy-the-operator">Deploy the operator</h2>
  715. <p>The operator is deployed using a HelmRelease manifest to deploy the Helm package, but due to the special race condition,
  716. the deployment must be disabled in the <code>values</code> of the manifest called <code>deployment.yaml</code>, as follows:</p>
  717. <div class="highlight"><pre><span></span><code><span class="c1"># How to manage values files. Ref: https://fluxcd.io/docs/guides/helmreleases/#refer-to-values-inside-the-chart</span>
  718. <span class="c1"># How to inject values: https://fluxcd.io/docs/guides/helmreleases/#cloud-storage</span>
  719. <span class="nn">---</span>
  720. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">helm.toolkit.fluxcd.io/v2beta1</span>
  721. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRelease</span>
  722. <span class="nt">metadata</span><span class="p">:</span>
  723. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  724. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  725. <span class="nt">spec</span><span class="p">:</span>
  726. <span class="c1"># Override Release name to avoid the pattern Namespace-Release</span>
  727. <span class="c1"># Ref: https://fluxcd.io/docs/components/helm/api/#helm.toolkit.fluxcd.io/v2beta1.HelmRelease</span>
  728. <span class="nt">releaseName</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  729. <span class="nt">targetNamespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  730. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  731. <span class="nt">chart</span><span class="p">:</span>
  732. <span class="nt">spec</span><span class="p">:</span>
  733. <span class="nt">chart</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  734. <span class="nt">version</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">0.3.9</span>
  735. <span class="nt">sourceRef</span><span class="p">:</span>
  736. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">HelmRepository</span>
  737. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  738. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  739. <span class="nt">values</span><span class="p">:</span>
  740. <span class="nt">installCRDs</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">false</span>
  741. <span class="c1"># Ref: https://fluxcd.io/docs/components/helm/api/#helm.toolkit.fluxcd.io/v2beta1.Install</span>
  742. <span class="nt">install</span><span class="p">:</span>
  743. <span class="nt">createNamespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  744. </code></pre></div>
  745. <h2 id="deploy-the-crs">Deploy the CRs</h2>
  746. <p>Now, be ready for the arcane magic. Create a Kustomization manifest called <code>deployment-crs.yaml</code> with the following content:</p>
  747. <div class="highlight"><pre><span></span><code><span class="nn">---</span>
  748. <span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">kustomize.toolkit.fluxcd.io/v1beta2</span>
  749. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Kustomization</span>
  750. <span class="nt">metadata</span><span class="p">:</span>
  751. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crs</span>
  752. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  753. <span class="nt">spec</span><span class="p">:</span>
  754. <span class="nt">dependsOn</span><span class="p">:</span>
  755. <span class="p p-Indicator">-</span> <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets-crds</span>
  756. <span class="nt">interval</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">10m</span>
  757. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./infrastructure/external-secrets/crs</span>
  758. <span class="nt">prune</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
  759. <span class="nt">sourceRef</span><span class="p">:</span>
  760. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  761. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  762. </code></pre></div>
  763. <p>There are several interesting details to see here, that finally solves the race condition:</p>
  764. <ol>
  765. <li>First one is the field <code>dependsOn</code>, which points to a previous Kustomization called <code>external-secrets-crds</code>. This
  766. dependency forces this deployment to wait for the other to be ready, before start being deployed.</li>
  767. <li>The reference to the place where to find the CRs
  768. <div class="highlight"><pre><span></span><code><span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">./infrastructure/external-secrets/crs</span>
  769. <span class="nt">sourceRef</span><span class="p">:</span>
  770. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">GitRepository</span>
  771. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">flux-system</span>
  772. </code></pre></div>
  773. Custom Resources will be searched in the relative path <code>./infrastructure/external-secrets/crs</code> of the GitRepository
  774. called <code>flux-system</code>, which is a reference to the same repository that FluxCD watches to synchronize the cluster.
  775. With fewer words, a reference to itself, but going to another directory called <code>crs</code></li>
  776. </ol>
  777. <p>Of course, allocate inside the mentioned path <code>./infrastructure/external-secrets/crs</code>, all the desired CRs to be deployed,
  778. for example, a manifest <code>clusterSecretStore.yaml</code> to reach your Hashicorp Vault as follows:</p>
  779. <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1alpha1</span>
  780. <span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">ClusterSecretStore</span>
  781. <span class="nt">metadata</span><span class="p">:</span>
  782. <span class="nt">name</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">vault-backend-global</span>
  783. <span class="nt">spec</span><span class="p">:</span>
  784. <span class="nt">provider</span><span class="p">:</span>
  785. <span class="nt">vault</span><span class="p">:</span>
  786. <span class="nt">server</span><span class="p">:</span> <span class="s">&quot;https://vault.your-domain.com&quot;</span>
  787. <span class="nt">path</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">secret</span>
  788. <span class="nt">version</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v2</span>
  789. <span class="nt">auth</span><span class="p">:</span>
  790. <span class="c1"># points to a secret that contains a vault token</span>
  791. <span class="c1"># https://www.vaultproject.io/docs/auth/token</span>
  792. <span class="nt">tokenSecretRef</span><span class="p">:</span>
  793. <span class="nt">name</span><span class="p">:</span> <span class="s">&quot;vault-token-global&quot;</span>
  794. <span class="nt">key</span><span class="p">:</span> <span class="s">&quot;token&quot;</span>
  795. <span class="nt">namespace</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
  796. </code></pre></div>
  797. <h2 id="results">Results</h2>
  798. <p>At the end, the required files tree is shown in the following picture:</p>
  799. <p><img alt="FluxCD files tree" src="../pictures/screenshot_gitops_final_directory_tree.png" /></p>
  800. </article>
  801. </div>
  802. </div>
  803. </main>
  804. <footer class="md-footer">
  805. <nav class="md-footer__inner md-grid" aria-label="Footer">
  806. <a href="../guides-using-latest-image/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Using Latest Image" rel="prev">
  807. <div class="md-footer__button md-icon">
  808. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
  809. </div>
  810. <div class="md-footer__title">
  811. <div class="md-ellipsis">
  812. <span class="md-footer__direction">
  813. Previous
  814. </span>
  815. Using Latest Image
  816. </div>
  817. </div>
  818. </a>
  819. <a href="../provider-aws-secrets-manager/" class="md-footer__link md-footer__link--next" aria-label="Next: Secrets Manager" rel="next">
  820. <div class="md-footer__title">
  821. <div class="md-ellipsis">
  822. <span class="md-footer__direction">
  823. Next
  824. </span>
  825. Secrets Manager
  826. </div>
  827. </div>
  828. <div class="md-footer__button md-icon">
  829. <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg>
  830. </div>
  831. </a>
  832. </nav>
  833. <div class="md-footer-meta md-typeset">
  834. <div class="md-footer-meta__inner md-grid">
  835. <div class="md-footer-copyright">
  836. Made with
  837. <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
  838. Material for MkDocs
  839. </a>
  840. </div>
  841. </div>
  842. </div>
  843. </footer>
  844. </div>
  845. <div class="md-dialog" data-md-component="dialog">
  846. <div class="md-dialog__inner md-typeset"></div>
  847. </div>
  848. <script id="__config" type="application/json">{"base": "..", "features": [], "translations": {"clipboard.copy": "Copy to clipboard", "clipboard.copied": "Copied to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.placeholder": "Type to start searching", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "search": "../assets/javascripts/workers/search.b0710199.min.js", "version": {"provider": "mike"}}</script>
  849. <script src="../assets/javascripts/bundle.76f349be.min.js"></script>
  850. </body>
  851. </html>