helm-external-secrets/docs/spec.md

Packages:

• external-secrets.io/v1alpha1

external-secrets.io/v1alpha1

Package v1alpha1 contains resources for external-secrets

Resource Types:

AWSAuth

(Appears on: AWSProvider)

AWSAuth contains a secretRef for credentials.

AWSAuthSecretRef

Field	Description
secretRef

AWSAuthSecretRef

(Appears on: AWSAuth)

AWSAuthSecretRef holds secret references for aws credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.

github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

Field	Description
accessKeyIDSecretRef
The AccessKeyID is used for authentication
secretAccessKeySecretRef
The SecretAccessKey is used for authentication

AWSProvider

(Appears on: SecretStoreProvider)

AWSProvider configures a store to sync secrets using the AWS Secret Manager provider.

AWSServiceType AWSAuth

Field	Description
service
Service defines which service should be used to fetch the secrets
auth
(Optional) Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials

role string (Optional)

Role is a Role ARN which the SecretManager provider will assume

region string

AWS Region to be used for the provider

AWSServiceType (string alias)

(Appears on: AWSProvider)

AWSServiceType is a enum that defines the service/API that is used to fetch the secrets

Value	Description
"ParameterStore"	AWSServiceParameterStore is the AWS SystemsManager ParameterStore see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
"SecretsManager"	AWSServiceSecretsManager is the AWS SecretsManager see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

ClusterSecretStore

ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Kubernetes meta/v1.ObjectMeta SecretStoreSpec SecretStoreProvider

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
string controller (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

ExternalSecret

ExternalSecret is the Schema for the external-secrets API.

Kubernetes meta/v1.ObjectMeta ExternalSecretSpec ExternalSecretTarget Kubernetes meta/v1.Duration

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
SecretStoreRef secretStoreRef
target
refreshInterval
RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.

data []ExternalSecretData (Optional)

Data defines the connection between the Kubernetes Secret keys and the Provider data

dataFrom []ExternalSecretDataRemoteRef (Optional)

DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

status ExternalSecretStatus

ExternalSecretConditionType (string alias)

(Appears on: ExternalSecretStatusCondition)

Value	Description
"Ready"

ExternalSecretCreationPolicy (string alias)

(Appears on: ExternalSecretTarget)

ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.

Value	Description
"Merge"	Merge does not create the Secret, but merges the data fields to the Secret.
"None"	None does not create a Secret (future use with injector).
"Owner"	Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.

ExternalSecretData

(Appears on: ExternalSecretSpec)

ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.

string ExternalSecretDataRemoteRef

Field	Description
secretKey
remoteRef

ExternalSecretDataRemoteRef

(Appears on: ExternalSecretData, ExternalSecretSpec)

ExternalSecretDataRemoteRef defines Provider data location.

string string

Field	Description
key
Key is the key used in the Provider, mandatory
version
(Optional) Used to select a specific version of the Provider value, if supported

property string (Optional)

Used to select a specific property of the Provider value (if a map), if supported

ExternalSecretSpec

(Appears on: ExternalSecret)

ExternalSecretSpec defines the desired state of ExternalSecret.

SecretStoreRef ExternalSecretTarget

Field	Description
secretStoreRef
target

refreshInterval Kubernetes meta/v1.Duration

RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.

data []ExternalSecretData (Optional)

Data defines the connection between the Kubernetes Secret keys and the Provider data

dataFrom []ExternalSecretDataRemoteRef (Optional)

DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

ExternalSecretStatus

(Appears on: ExternalSecret)

Kubernetes meta/v1.Time []ExternalSecretStatusCondition

Field	Description
refreshTime
refreshTime is the time and date the external secret was fetched and the target secret updated
conditions
(Optional)

ExternalSecretStatusCondition

(Appears on: ExternalSecretStatus)

ExternalSecretConditionType Kubernetes core/v1.ConditionStatus

Field	Description
type
status

reason string (Optional) message string (Optional) lastTransitionTime Kubernetes meta/v1.Time (Optional)

ExternalSecretTarget

(Appears on: ExternalSecretSpec)

ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.

string ExternalSecretCreationPolicy

Field	Description
name
(Optional) Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
creationPolicy
(Optional) CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’

ExternalSecretTemplate

ExternalSecretTemplate defines a blueprint for the created Secret resource.

Kubernetes core/v1.SecretType ExternalSecretTemplateMetadata

Field	Description
type
(Optional)
metadata
(Optional)

ExternalSecretTemplateMetadata

(Appears on: ExternalSecretTemplate)

ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.

map[string]string map[string]string

Field	Description
annotations
(Optional)
labels
(Optional)

GenericStore

GenericStore is a common interface for interacting with ClusterSecretStore or a namespaced SecretStore.

ProviderIdentity

ProviderIdentity returns the name of a secret store provider this interface must be implemented by every provider

SecretStore

SecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Kubernetes meta/v1.ObjectMeta SecretStoreSpec SecretStoreProvider

Field	Description
metadata
Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
string controller (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

status SecretStoreStatus

SecretStoreConditionType (string alias)

(Appears on: SecretStoreStatusCondition)

Value	Description
"Ready"

SecretStoreProvider

(Appears on: SecretStoreSpec)

SecretStoreProvider contains the provider-specific configration.

AWSProvider

Field	Description
aws
(Optional) AWS configures this store to sync secrets using AWS Secret Manager provider

SecretStoreRef

(Appears on: ExternalSecretSpec)

SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.

string string

Field	Description
name
Name of the SecretStore resource
kind
(Optional) Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to SecretStore

SecretStoreSpec

(Appears on: ClusterSecretStore, SecretStore)

SecretStoreSpec defines the desired state of SecretStore.

string SecretStoreProvider

Field	Description
controller
(Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider
Used to configure the provider. Only one provider may be set

SecretStoreStatus

(Appears on: SecretStore)

SecretStoreStatus defines the observed state of the SecretStore.

[]SecretStoreStatusCondition

Field	Description
conditions
(Optional)

SecretStoreStatusCondition

(Appears on: SecretStoreStatus)

SecretStoreConditionType Kubernetes core/v1.ConditionStatus

Field	Description
type
status

reason string (Optional) message string (Optional) lastTransitionTime Kubernetes meta/v1.Time (Optional)

---

Generated with gen-crd-api-reference-docs.