logic855
/
helm-external-secrets
Mirror von https://github.com/external-secrets/external-secrets


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936
							
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
        <link rel="prev" href="../security-best-practices/">
      
      
        <link rel="next" href="../v1beta1/">
      
      
      <link rel="icon" href="../../pictures/eso-round-logo.svg">
      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.5.42">
    
    
        <title>Threat Model - External Secrets Operator</title>
      
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.0253249f.min.css">
      
        
        <link rel="stylesheet" href="../../assets/stylesheets/palette.06af60db.min.css">
      
      
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    <script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      
<script id="__analytics">function __md_analytics(){function e(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],e("js",new Date),e("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",(function(){document.forms.search&&document.forms.search.query.addEventListener("blur",(function(){this.value&&e("event","search",{search_term:this.value})}));document$.subscribe((function(){var t=document.forms.feedback;if(void 0!==t)for(var a of t.querySelectorAll("[type=submit]"))a.addEventListener("click",(function(a){a.preventDefault();var n=document.location.pathname,d=this.getAttribute("data-md-value");e("event","feedback",{page:n,data:d}),t.firstElementChild.disabled=!0;var r=t.querySelector(".md-feedback__note [data-md-value='"+d+"']");r&&(r.hidden=!1)})),t.hidden=!1})),location$.subscribe((function(t){e("config","G-QP38TD8K7V",{page_path:t.pathname})}))}));var t=document.createElement("script");t.async=!0,t.src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V",document.getElementById("__analytics").insertAdjacentElement("afterEnd",t)}</script>
  
    <script>"undefined"!=typeof __md_analytics&&__md_analytics()</script>
  

  </head>
  
  
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
  
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#background" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-color-scheme="default" data-md-component="outdated" hidden>
        
          <aside class="md-banner md-banner--warning">
            <div class="md-banner__inner md-grid md-typeset">
              
  You're not viewing the latest version.
  <a href="../../..">
    <strong>Click here to go to latest.</strong>
  </a>

            </div>
            <script>var el=document.querySelector("[data-md-component=outdated]"),outdated=__md_get("__outdated",sessionStorage);!0===outdated&&el&&(el.hidden=!1)</script>
          </aside>
        
      </div>
    
    
<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../.." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  <img src="../../pictures/eso-round-logo.svg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            External Secrets Operator
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              Threat Model
            
          </span>
        </div>
      </div>
    </div>
    
      
        <form class="md-header__option" data-md-component="palette">
  
    
    <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo"  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_0">
    
      <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
      </label>
    
  
    <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="indigo"  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_1">
    
      <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
      </label>
    
  
</form>
      
    
      <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
    
    
      <label class="md-header__button md-icon" for="__search">
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
          
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
        </button>
      </nav>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list" role="presentation"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
      <div class="md-header__source">
        <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.6.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
      </div>
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-grid">
    <ul class="md-tabs__list">
      
        
      <li class="md-tabs__item">
        <a href="../.." class="md-tabs__link">
          
  
  Introduction

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../api/components/" class="md-tabs__link">
          
  
  API

        </a>
      </li>
    
  
      <li class="md-tabs__item md-tabs__item--active">
        <a href="../introduction/" class="md-tabs__link">
          
  
  Guides

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../provider/aws-secrets-manager/" class="md-tabs__link">
          
  
  Provider

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../examples/gitops-using-fluxcd/" class="md-tabs__link">
          
  
  Examples

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../contributing/devguide/" class="md-tabs__link">
          
  
  Community

        </a>
      </li>
    
  
    </ul>
  </div>
</nav>
          
        
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../.." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  <img src="../../pictures/eso-round-logo.svg" alt="logo">

    </a>
    External Secrets Operator
  </label>
  
    <div class="md-nav__source">
      <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.6.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_1" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../.." class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    Introduction
  </span>
  

            </a>
            
              
              <label class="md-nav__link " for="__nav_1" id="__nav_1_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_1">
            <span class="md-nav__icon md-icon"></span>
            Introduction
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../introduction/overview/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Overview
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/getting-started/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Getting started
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/faq/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    FAQ
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/stability-support/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Stability and Support
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/deprecation-policy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Deprecation Policy
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2" >
        
          
          <label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    API
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2">
            <span class="md-nav__icon md-icon"></span>
            API
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/components/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Components
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_2" >
        
          
          <label class="md-nav__link" for="__nav_2_2" id="__nav_2_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Core Resources
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2">
            <span class="md-nav__icon md-icon"></span>
            Core Resources
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/externalsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    ExternalSecret
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/secretstore/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    SecretStore
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clustersecretstore/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    ClusterSecretStore
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clusterexternalsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    ClusterExternalSecret
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/pushsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    PushSecret
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_3" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../api/generator/" class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    Generators
  </span>
  

            </a>
            
              
              <label class="md-nav__link " for="__nav_2_3" id="__nav_2_3_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_3">
            <span class="md-nav__icon md-icon"></span>
            Generators
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/generator/acr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Azure Container Registry
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/ecr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    AWS Elastic Container Registry
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/gcr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Google Container Registry
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Vault Dynamic Secret
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/password/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Password
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/fake/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Fake
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/webhook/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Webhook
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/github/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Github
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/uuid/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    UUID
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_4" >
        
          
          <label class="md-nav__link" for="__nav_2_4" id="__nav_2_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Reference Docs
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_4">
            <span class="md-nav__icon md-icon"></span>
            Reference Docs
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/spec/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    API specification
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/controller-options/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Controller Options
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/metrics/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Metrics
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" checked>
        
          
          <label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="">
            
  
  <span class="md-ellipsis">
    Guides
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3">
            <span class="md-nav__icon md-icon"></span>
            Guides
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../introduction/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Introduction
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2" >
        
          
          <label class="md-nav__link" for="__nav_3_2" id="__nav_3_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    External Secrets
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_2">
            <span class="md-nav__icon md-icon"></span>
            External Secrets
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../all-keys-one-secret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Extract structured data
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../getallsecrets/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Find Secrets by Name or Metadata
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../datafrom-rewrite/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Rewriting Keys
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2_4" >
        
          
          <label class="md-nav__link" for="__nav_3_2_4" id="__nav_3_2_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Advanced Templating
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_3_2_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_2_4">
            <span class="md-nav__icon md-icon"></span>
            Advanced Templating
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../templating/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    v2
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../templating-v1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    v1
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../common-k8s-secret-types/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Kubernetes Secret Types
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../ownership-deletion-policy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Lifecycle: ownership & deletion
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../decoding-strategy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Decoding Strategies
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../controller-class/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Controller Classes
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../generator/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Generators
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../pushsecrets/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Push Secrets
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_5" checked>
        
          
          <label class="md-nav__link" for="__nav_3_5" id="__nav_3_5_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Operations
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_5_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3_5">
            <span class="md-nav__icon md-icon"></span>
            Operations
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../multi-tenancy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Multi Tenancy
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../security-best-practices/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Security Best Practices
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          
  
  <span class="md-ellipsis">
    Threat Model
  </span>
  

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  <span class="md-ellipsis">
    Threat Model
  </span>
  

      </a>
      
        
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#background" class="md-nav__link">
    <span class="md-ellipsis">
      Background
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Background">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#summary" class="md-nav__link">
    <span class="md-ellipsis">
      Summary
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#components" class="md-nav__link">
    <span class="md-ellipsis">
      Components
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#overview" class="md-nav__link">
    <span class="md-ellipsis">
      Overview
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Overview">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#scope" class="md-nav__link">
    <span class="md-ellipsis">
      Scope
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#assets" class="md-nav__link">
    <span class="md-ellipsis">
      Assets
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Assets">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#a01-cluster-level-access-to-secrets" class="md-nav__link">
    <span class="md-ellipsis">
      A01: Cluster-Level access to secrets
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a02-crd-and-webhook-write-access" class="md-nav__link">
    <span class="md-ellipsis">
      A02: CRD and Webhook Write access
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a03-secret-provider-access" class="md-nav__link">
    <span class="md-ellipsis">
      A03: secret provider access
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a04-capability-to-modify-resources" class="md-nav__link">
    <span class="md-ellipsis">
      A04: capability to modify resources
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#threats" class="md-nav__link">
    <span class="md-ellipsis">
      Threats
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Threats">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#t01-tampering-with-resources-through-mitm" class="md-nav__link">
    <span class="md-ellipsis">
      T01: Tampering with resources through MITM
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t02-webhook-dos" class="md-nav__link">
    <span class="md-ellipsis">
      T02: Webhook DOS
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t03-unauthorized-access-to-cluster-secrets" class="md-nav__link">
    <span class="md-ellipsis">
      T03: Unauthorized access to cluster secrets
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t04-unauthorized-access-to-secret-provider-credentials" class="md-nav__link">
    <span class="md-ellipsis">
      T04: unauthorized access to secret provider credentials
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t05-data-exfiltration-through-malicious-resources" class="md-nav__link">
    <span class="md-ellipsis">
      T05: data exfiltration through malicious resources
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t06-supply-chain-attacks" class="md-nav__link">
    <span class="md-ellipsis">
      T06: supply chain attacks
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t07-malicious-workloads-in-eso-namespace" class="md-nav__link">
    <span class="md-ellipsis">
      T07: malicious workloads in eso namespace
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#controls" class="md-nav__link">
    <span class="md-ellipsis">
      Controls
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Controls">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#c01-network-security-policy" class="md-nav__link">
    <span class="md-ellipsis">
      C01: Network Security Policy
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c02-least-privilege-rbac" class="md-nav__link">
    <span class="md-ellipsis">
      C02: Least Privilege RBAC
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c03-policy-enforcement" class="md-nav__link">
    <span class="md-ellipsis">
      C03: Policy Enforcement
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c04-provider-access-policy" class="md-nav__link">
    <span class="md-ellipsis">
      C04: Provider Access Policy
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c05-entirely-disable-crds" class="md-nav__link">
    <span class="md-ellipsis">
      C05: Entirely disable CRDs
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../v1beta1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Upgrading to v1beta1
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../using-latest-image/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Using Latest Image
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../disable-cluster-features/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Disable Cluster Features
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_4" >
        
          
          <label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Provider
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4">
            <span class="md-nav__icon md-icon"></span>
            Provider
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../provider/aws-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    AWS Secrets Manager
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/aws-parameter-store/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    AWS Parameter Store
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/azure-key-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Azure Key Vault
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/beyondtrust/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    BeyondTrust
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/bitwarden-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Bitwarden Secrets Manager
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/chef/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Chef
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/conjur/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    CyberArk Conjur
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/device42/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Device42
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/google-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Google Cloud Secret Manager
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/hashicorp-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    HashiCorp Vault
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/kubernetes/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Kubernetes
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/ibm-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    IBM Secrets Manager
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/akeyless/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Akeyless
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-certificate-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Yandex Certificate Manager
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-lockbox/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Yandex Lockbox
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/alibaba/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Alibaba Cloud
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/gitlab-variables/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    GitLab Variables
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/oracle-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Oracle Vault
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/1password-automation/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    1Password Secrets Automation
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/webhook/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Webhook
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/fake/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Fake
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/senhasegura-dsm/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    senhasegura DevOps Secrets Management (DSM)
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/doppler/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Doppler
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/keeper-security/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Keeper Security
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/cloak/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Cloak End 2 End Encrypted Secrets
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/scaleway/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Scaleway
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/delinea/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Delinea
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/secretserver/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Secret Server
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/passbolt/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Passbolt
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/pulumi/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Pulumi ESC
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/onboardbase/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Onboardbase
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider-passworddepot/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Password Depot
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/fortanix/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Fortanix
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/infisical/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Infisical
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/previder/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Previder
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_5" >
        
          
          <label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Examples
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_5">
            <span class="md-nav__icon md-icon"></span>
            Examples
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../examples/gitops-using-fluxcd/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    FluxCD
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/anchore-engine-credentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Anchore Engine
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/jenkins-kubernetes-credentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Jenkins
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/bitwarden/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    BitWarden
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6" >
        
          
          <label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Community
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6">
            <span class="md-nav__icon md-icon"></span>
            Community
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_1" >
        
          
          <label class="md-nav__link" for="__nav_6_1" id="__nav_6_1_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Contributing
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6_1">
            <span class="md-nav__icon md-icon"></span>
            Contributing
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../contributing/devguide/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Developer guide
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/process/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Contributing Process
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/release/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Release Process
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/coc/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Code of Conduct
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/roadmap/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Roadmap
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_2" >
        
          
          <label class="md-nav__link" for="__nav_6_2" id="__nav_6_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    External Resources
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6_2">
            <span class="md-nav__icon md-icon"></span>
            External Resources
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../eso-talks/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Talks
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-demos/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Demos
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-blogs/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Blogs
  </span>
  

      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-tools/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Tools
  </span>
  

      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" hidden>
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#background" class="md-nav__link">
    <span class="md-ellipsis">
      Background
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Background">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#summary" class="md-nav__link">
    <span class="md-ellipsis">
      Summary
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#components" class="md-nav__link">
    <span class="md-ellipsis">
      Components
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#overview" class="md-nav__link">
    <span class="md-ellipsis">
      Overview
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Overview">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#scope" class="md-nav__link">
    <span class="md-ellipsis">
      Scope
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#assets" class="md-nav__link">
    <span class="md-ellipsis">
      Assets
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Assets">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#a01-cluster-level-access-to-secrets" class="md-nav__link">
    <span class="md-ellipsis">
      A01: Cluster-Level access to secrets
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a02-crd-and-webhook-write-access" class="md-nav__link">
    <span class="md-ellipsis">
      A02: CRD and Webhook Write access
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a03-secret-provider-access" class="md-nav__link">
    <span class="md-ellipsis">
      A03: secret provider access
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#a04-capability-to-modify-resources" class="md-nav__link">
    <span class="md-ellipsis">
      A04: capability to modify resources
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#threats" class="md-nav__link">
    <span class="md-ellipsis">
      Threats
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Threats">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#t01-tampering-with-resources-through-mitm" class="md-nav__link">
    <span class="md-ellipsis">
      T01: Tampering with resources through MITM
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t02-webhook-dos" class="md-nav__link">
    <span class="md-ellipsis">
      T02: Webhook DOS
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t03-unauthorized-access-to-cluster-secrets" class="md-nav__link">
    <span class="md-ellipsis">
      T03: Unauthorized access to cluster secrets
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t04-unauthorized-access-to-secret-provider-credentials" class="md-nav__link">
    <span class="md-ellipsis">
      T04: unauthorized access to secret provider credentials
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t05-data-exfiltration-through-malicious-resources" class="md-nav__link">
    <span class="md-ellipsis">
      T05: data exfiltration through malicious resources
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t06-supply-chain-attacks" class="md-nav__link">
    <span class="md-ellipsis">
      T06: supply chain attacks
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#t07-malicious-workloads-in-eso-namespace" class="md-nav__link">
    <span class="md-ellipsis">
      T07: malicious workloads in eso namespace
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#controls" class="md-nav__link">
    <span class="md-ellipsis">
      Controls
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Controls">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#c01-network-security-policy" class="md-nav__link">
    <span class="md-ellipsis">
      C01: Network Security Policy
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c02-least-privilege-rbac" class="md-nav__link">
    <span class="md-ellipsis">
      C02: Least Privilege RBAC
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c03-policy-enforcement" class="md-nav__link">
    <span class="md-ellipsis">
      C03: Policy Enforcement
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c04-provider-access-policy" class="md-nav__link">
    <span class="md-ellipsis">
      C04: Provider Access Policy
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#c05-entirely-disable-crds" class="md-nav__link">
    <span class="md-ellipsis">
      C05: Entirely disable CRDs
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
                  </div>
                </div>
              </div>
            
          
            <div class="md-content" data-md-component="content">
              <article class="md-content__inner md-typeset">
                
                  
  <h1>Threat Model</h1>

<h2 id="background">Background</h2>
<p>The External Secrets Operator is a Kubernetes Operator that seamlessly incorporates external secret management systems into Kubernetes. This Operator retrieves data from the external API and generates Kubernetes Secret resources using the corresponding secret values. This process occurs continuously in the background through regular polling of the external API. Consequently, whenever a secret undergoes changes in the external API, the corresponding Kubernetes Secret will also be updated accordingly.</p>
<h3 id="summary">Summary</h3>
<table>
<thead>
<tr>
<th>Purpose</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>Intended Usage</td>
<td>Sync Secrets into Kubernetes</td>
</tr>
<tr>
<td>Data Classifiation</td>
<td>Critical</td>
</tr>
<tr>
<td>Highest Risk Impact</td>
<td>Organisation takeover</td>
</tr>
</tbody>
</table>
<h3 id="components">Components</h3>
<p>ESO comprises three main components: <code>webhook</code>, <code>cert controller</code> and a <code>core controller</code>. For more detailed information, please refer to the documentation on <a href="../../api/components/">components</a>.</p>
<h2 id="overview">Overview</h2>
<p>This section provides an overview of the security aspects of the External Secrets Operator (ESO) and includes information on assets, threats, and controls involved in its operation.</p>
<p>The following diagram illustrates the security perspective of how ESO functions, highlighting the assets (items to protect), threats (potential risks), and controls (measures to mitigate threats).</p>
<p><img alt="Overview" src="../../pictures/eso-threat-model-overview.drawio.png" /></p>
<h3 id="scope">Scope</h3>
<p>For the purpose of this threat model, we assume an ESO installation using helm and default settings on a public cloud provider. It is important to note that the <a href="https://github.com/kubernetes/community/tree/master/sig-security">Kubernetes SIG Security</a> team has defined an <a href="https://github.com/kubernetes/sig-security/blob/main/sig-security-docs/papers/admission-control/kubernetes-admission-control-threat-model.md">Admission Control Threat Model</a>, which is recommended reading for a better understanding of the security aspects that partially apply to External Secrets Operator.</p>
<p>ESO utilizes the <code>ValidatingWebhookConfiguration</code> mechanism to validate <code>(Cluster)SecretStore</code> and <code>(Cluster)ExternalSecret</code> resources. However, it is essential to understand that this validation process does not serve as a security control mechanism. Instead, ESO performs validation by enforcing additional rules that go beyond the <a href="https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation">CustomResourceDefinition OpenAPI v3 Validation schema</a>.</p>
<h3 id="assets">Assets</h3>
<h4 id="a01-cluster-level-access-to-secrets">A01: Cluster-Level access to secrets</h4>
<p>The controller possesses privileged access to the <code>kube-apiserver</code> and is authorized to read and write secret resources across all namespaces within a cluster.</p>
<h4 id="a02-crd-and-webhook-write-access">A02: CRD and Webhook Write access</h4>
<p>The cert-controller component has read/write access to <code>ValidatingWebhookConfigurations</code> and <code>CustomResourceDefinitions</code> resources. This access is necessary to inject/modify the caBundle property.</p>
<h4 id="a03-secret-provider-access">A03: secret provider access</h4>
<p>The <code>core-controller</code> component accesses a secret provider using user-supplied credentials. These credentials can be derived from environment variables, mounted service account tokens, files within the controller container, or fetched from the Kubernetes API (e.g., <code>Kind=Secret</code>). The scope of these credentials may vary, potentially providing full access to a cloud provider.</p>
<h4 id="a04-capability-to-modify-resources">A04: capability to modify resources</h4>
<p>The webhook component validates and converts ExternalSecret and SecretStore resources. The conversion webhook is essential for migrating resources from the old version <code>v1alpha1</code> to the new version <code>v1beta1</code>. The webhook component possesses the ability to modify resources during runtime.</p>
<h3 id="threats">Threats</h3>
<h4 id="t01-tampering-with-resources-through-mitm">T01: Tampering with resources through MITM</h4>
<p>An adversary could launch a Man-in-the-Middle (MITM) attack to hijack the webhook pod, enabling them to manipulate the data of the conversion webhook. This could involve injecting malicious resources or causing a Denial-of-Service (DoS) attack. To mitigate this threat, a mutual authentication mechanism should be enforced for the connection between the Kubernetes API server and the webhook service to ensure that only authenticated endpoints can communicate.</p>
<h4 id="t02-webhook-dos">T02: Webhook DOS</h4>
<p>Currently, ESO generates an X.509 certificate for webhook registration without authenticating the kube-apiserver. Consequently, if an attacker gains network access to the webhook Pod, they can overload the webhook server and initiate a DoS attack. As a result, modifications to ESO resources may fail, and the ESO core controller may be impacted due to the unavailability of the conversion webhook.</p>
<h4 id="t03-unauthorized-access-to-cluster-secrets">T03: Unauthorized access to cluster secrets</h4>
<p>An attacker can gain unauthorized access to secrets by utilizing the service account token of the ESO core controller Pod or exploiting software vulnerabilities. This unauthorized access allows the attacker to read secrets within the cluster, potentially leading to a cluster takeover.</p>
<h4 id="t04-unauthorized-access-to-secret-provider-credentials">T04: unauthorized access to secret provider credentials</h4>
<p>An attacker can gain unauthorized access to credentials that provide access to external APIs storing secrets. If the credentials have overly broad permissions, this could result in an organization takeover.</p>
<h4 id="t05-data-exfiltration-through-malicious-resources">T05: data exfiltration through malicious resources</h4>
<p>An attacker can exfiltrate data from the cluster by utilizing maliciously crafted resources. Multiple attack vectors can be employed, e.g.:</p>
<ol>
<li>copying data from a namespace to an unauthorized namespace</li>
<li>exfiltrating data to an unauthorized secret provider</li>
<li>exfiltrating data through an authorized secret provider to a malicious provider account</li>
</ol>
<p>Successful data exfiltration can lead to intellectual property loss, information misuse, loss of customer trust, and damage to the brand or reputation.</p>
<h4 id="t06-supply-chain-attacks">T06: supply chain attacks</h4>
<p>An attack can infiltrate the ESO container through various attack vectors. The following are some potential entry points, although this is not an exhaustive list. For a comprehensive analysis, refer to <a href="https://slsa.dev/spec/v0.1/threats">SLSA Threats and mitigations</a> or <a href="https://cloud.google.com/software-supply-chain-security/docs/attack-vectors">GCP software supply chain threats</a>.</p>
<ol>
<li>Source Threats: Unauthorized changes or inclusion of vulnerable code in ESO through code submissions.</li>
<li>Build Threats: Creation and distribution of malicious builds of ESO, such as in container registries, Artifact Hub, or Operator Hub.</li>
<li>Dependency Threats: Introduction of vulnerable code into ESO dependencies.</li>
<li>Deployment and Runtime Threats: Injection of malicious code through compromised deployment processes.</li>
</ol>
<h4 id="t07-malicious-workloads-in-eso-namespace">T07: malicious workloads in eso namespace</h4>
<p>An attacker can deploy malicious workloads within the external-secrets namespace, taking advantage of the ESO service account with potentially cluster-wide privileges.</p>
<h3 id="controls">Controls</h3>
<h4 id="c01-network-security-policy">C01: Network Security Policy</h4>
<p>Implement a NetworkPolicy to restrict traffic in both inbound and outbound directions on all networks. Employ a "deny all" / "permit by exception" approach for inbound and outbound network traffic. The specific network policies for the core-controller depend on the chosen provider. The webhook and cert-controller have well-defined sets of endpoints they communicate with. Refer to the <a href="../security-best-practices/">Security Best Practices</a> documentation for inbound and outbound network requirements.</p>
<p>Please note that ESO does not provide pre-packaged network policies, and it is the user's responsibility to implement the necessary security controls.</p>
<h4 id="c02-least-privilege-rbac">C02: Least Privilege RBAC</h4>
<p>Adhere to the principle of least privilege by configuring Role-Based Access Control (RBAC) permissions not only for the ESO workload but also for all users interacting with it. Ensure that RBAC permissions on provider side are appropriate according to your setup, by for example limiting which sensitive information a given credential can have access to. Ensure that  kubernetes RBAC are set up to grant access to ESO resources only where necessary. For example, allowing write access to <code>ClusterSecretStore</code>/<code>ExternalSecret</code> may be sufficient for a threat to become a reality.</p>
<h4 id="c03-policy-enforcement">C03: Policy Enforcement</h4>
<p>Implement a Policy Engine such as Kyverno or OPA to enforce restrictions on changes to ESO resources. The specific policies to be enforced depend on the environment. Here are a few suggestions:</p>
<ol>
<li>(Cluster)SecretStore: Restrict the allowed secret providers, disallowing unused or undesired providers (e.g. Webhook).</li>
<li>(Cluster)SecretStore: Restrict the permitted authentication mechanisms (e.g. prevent usage of <code>secretRef</code>).</li>
<li>(Cluster)SecretStore: Enforce limitations on modifications to provider-specific fields relevant for security, such as <code>caBundle</code>, <code>caProvider</code>, <code>region</code>, <code>role</code>, <code>url</code>, <code>environmentType</code>, <code>identityId</code>, and <code>others</code>.</li>
<li>ClusterSecretStore: Control the usage of <code>namespaceSelector</code>, such as forbidding or mandating the usage of the <code>kube-system</code> namespace.</li>
<li>ClusterExternalSecret: Restrict the usage of <code>namespaceSelector</code>.</li>
</ol>
<p>Please note that ESO does not provide pre-packaged policies, and it is the user's responsibility to implement the necessary security controls.</p>
<h4 id="c04-provider-access-policy">C04: Provider Access Policy</h4>
<p>Configure fine-grained access control on the HTTP endpoint of the secret provider to prevent data exfiltration across accounts or organizations. Consult the documentation of your specific provider (e.g.: <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html">AWS Secrets Manager VPC Endpoint Policies</a>, <a href="https://cloud.google.com/vpc/docs/private-service-connect">GCP Private Service Connect</a>, or <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service">Azure Private Link</a>) for guidance on setting up access policies.</p>
<h4 id="c05-entirely-disable-crds">C05: Entirely disable CRDs</h4>
<p>You should disable unused CRDs to narrow down your attack surface. Not all users require the use of <code>PushSecret</code>, <code>ClusterSecretStore</code> or <code>ClusterExternalSecret</code> resources.</p>


              </article>
            </div>
          
          
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
        </div>
        
      </main>
      
<img referrerpolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=6658a9eb-067d-49f1-94f2-b8b00f21451e" />
  
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      &copy; 2024 The external-secrets Authors.<br/>
&copy; 2024 The Linux Foundation. All rights reserved.<br/><br/>
The Linux Foundation has registered trademarks and uses trademarks.<br/>
For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage/">Trademark Usage page</a>.

    </div>
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      

    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    
    <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "navigation.expand"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"provider": "mike"}}</script>
    
    
      <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script>
      
    
  </body>
</html>