logic855
/
helm-external-secrets
mirror of https://github.com/external-secrets/external-secrets


			
							12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519
							
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
        <link rel="prev" href="../multi-tenancy/">
      
      
        <link rel="next" href="../v1beta1/">
      
      <link rel="icon" href="../../assets/images/favicon.png">
      <meta name="generator" content="mkdocs-1.4.3, mkdocs-material-9.1.9">
    
    
        <title>Security Best Practices - External Secrets Operator</title>
      
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.85bb2934.min.css">
      
      
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    <script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce((e,_)=>(e<<5)-e+_.charCodeAt(0),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      
  <script id="__analytics">function __md_analytics(){function n(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],n("js",new Date),n("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",function(){document.forms.search&&document.forms.search.query.addEventListener("blur",function(){this.value&&n("event","search",{search_term:this.value})}),document$.subscribe(function(){var a=document.forms.feedback;if(void 0!==a)for(var e of a.querySelectorAll("[type=submit]"))e.addEventListener("click",function(e){e.preventDefault();var t=document.location.pathname,e=this.getAttribute("data-md-value");n("event","feedback",{page:t,data:e}),a.firstElementChild.disabled=!0;e=a.querySelector(".md-feedback__note [data-md-value='"+e+"']");e&&(e.hidden=!1)}),a.hidden=!1}),location$.subscribe(function(e){n("config","G-QP38TD8K7V",{page_path:e.pathname})})});var e=document.createElement("script");e.async=!0,e.src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V",document.getElementById("__analytics").insertAdjacentElement("afterEnd",e)}</script>

  
    <script>"undefined"!=typeof __md_analytics&&__md_analytics()</script>
  

  </head>
  
  
    <body dir="ltr">
  
    
      <script>var palette=__md_get("__palette");if(palette&&"object"==typeof palette.color)for(var key of Object.keys(palette.color))document.body.setAttribute("data-md-color-"+key,palette.color[key])</script>
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#security-best-practices" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-color-scheme="default" data-md-component="outdated" hidden>
        
          <aside class="md-banner md-banner--warning">
            <div class="md-banner__inner md-grid md-typeset">
              
  You're not viewing the latest version.
  <a href="../../..">
    <strong>Click here to go to latest.</strong>
  </a>

            </div>
            <script>var el=document.querySelector("[data-md-component=outdated]"),outdated=__md_get("__outdated",sessionStorage);!0===outdated&&el&&(el.hidden=!1)</script>
          </aside>
        
      </div>
    
    
<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../.." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  
  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg>

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2Z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            External Secrets Operator
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              Security Best Practices
            
          </span>
        </div>
      </div>
    </div>
    
    
      <label class="md-header__button md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12Z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41Z"/></svg>
        </button>
      </nav>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list" role="presentation"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
      <div class="md-header__source">
        <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.4.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
      </div>
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-grid">
    <ul class="md-tabs__list">
      
        
    <li class="md-tabs__item">
      <a href="../.." class="md-tabs__link">
        Introduction
      </a>
    </li>
  

    <li class="md-tabs__item">
      <a href="../../api/components/" class="md-tabs__link">
        API
      </a>
    </li>
  

    <li class="md-tabs__item">
      <a href="../introduction/" class="md-tabs__link md-tabs__link--active">
        Guides
      </a>
    </li>
  

    <li class="md-tabs__item">
      <a href="../../provider/aws-secrets-manager/" class="md-tabs__link">
        Provider
      </a>
    </li>
  

    <li class="md-tabs__item">
      <a href="../../examples/gitops-using-fluxcd/" class="md-tabs__link">
        Examples
      </a>
    </li>
  

    <li class="md-tabs__item">
      <a href="../../contributing/devguide/" class="md-tabs__link">
        Community
      </a>
    </li>
  

    </ul>
  </div>
</nav>
          
        
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../.." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  
  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg>

    </a>
    External Secrets Operator
  </label>
  
    <div class="md-nav__source">
      <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.4.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_1" >
      
      
        <div class="md-nav__link md-nav__link--index ">
          <a href="../..">Introduction</a>
          
            <label for="__nav_1">
              <span class="md-nav__icon md-icon"></span>
            </label>
          
        </div>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_1_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_1">
          <span class="md-nav__icon md-icon"></span>
          Introduction
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../introduction/overview/" class="md-nav__link">
        Overview
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/getting-started/" class="md-nav__link">
        Getting started
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/faq/" class="md-nav__link">
        FAQ
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/stability-support/" class="md-nav__link">
        Stability and Support
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/deprecation-policy/" class="md-nav__link">
        Deprecation Policy
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2" >
      
      
        <label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
          API
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_2">
          <span class="md-nav__icon md-icon"></span>
          API
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../api/components/" class="md-nav__link">
        Components
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_2" >
      
      
        <label class="md-nav__link" for="__nav_2_2" id="__nav_2_2_label" tabindex="0">
          Core Resources
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_2_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_2_2">
          <span class="md-nav__icon md-icon"></span>
          Core Resources
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../api/externalsecret/" class="md-nav__link">
        ExternalSecret
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/secretstore/" class="md-nav__link">
        SecretStore
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clustersecretstore/" class="md-nav__link">
        ClusterSecretStore
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clusterexternalsecret/" class="md-nav__link">
        ClusterExternalSecret
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/pushsecret/" class="md-nav__link">
        PushSecret
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_3" >
      
      
        <div class="md-nav__link md-nav__link--index ">
          <a href="../../api/generator/">Generators</a>
          
            <label for="__nav_2_3">
              <span class="md-nav__icon md-icon"></span>
            </label>
          
        </div>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_2_3">
          <span class="md-nav__icon md-icon"></span>
          Generators
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../api/generator/acr/" class="md-nav__link">
        Azure Container Registry
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/ecr/" class="md-nav__link">
        AWS Elastic Container Registry
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/gcr/" class="md-nav__link">
        Google Container Registry
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/vault/" class="md-nav__link">
        Vault Dynamic Secret
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/password/" class="md-nav__link">
        Password
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/fake/" class="md-nav__link">
        Fake
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_4" >
      
      
        <label class="md-nav__link" for="__nav_2_4" id="__nav_2_4_label" tabindex="0">
          Reference Docs
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_4_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_2_4">
          <span class="md-nav__icon md-icon"></span>
          Reference Docs
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../api/spec/" class="md-nav__link">
        API specification
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/controller-options/" class="md-nav__link">
        Controller Options
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/metrics/" class="md-nav__link">
        Metrics
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" checked>
      
      
        <label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
          Guides
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
        <label class="md-nav__title" for="__nav_3">
          <span class="md-nav__icon md-icon"></span>
          Guides
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../introduction/" class="md-nav__link">
        Introduction
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2" >
      
      
        <label class="md-nav__link" for="__nav_3_2" id="__nav_3_2_label" tabindex="0">
          External Secrets
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_2_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_3_2">
          <span class="md-nav__icon md-icon"></span>
          External Secrets
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../all-keys-one-secret/" class="md-nav__link">
        Extract structured data
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../getallsecrets/" class="md-nav__link">
        Find Secrets by Name or Metadata
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../datafrom-rewrite/" class="md-nav__link">
        Rewriting Keys
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2_4" >
      
      
        <label class="md-nav__link" for="__nav_3_2_4" id="__nav_3_2_4_label" tabindex="0">
          Advanced Templating
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_3_2_4_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_3_2_4">
          <span class="md-nav__icon md-icon"></span>
          Advanced Templating
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../templating/" class="md-nav__link">
        v2
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../templating-v1/" class="md-nav__link">
        v1
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item">
      <a href="../common-k8s-secret-types/" class="md-nav__link">
        Kubernetes Secret Types
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../ownership-deletion-policy/" class="md-nav__link">
        Lifecycle: ownership & deletion
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../decoding-strategy/" class="md-nav__link">
        Decoding Strategies
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../controller-class/" class="md-nav__link">
        Controller Classes
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item">
      <a href="../generator/" class="md-nav__link">
        Generators
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_4" checked>
      
      
        <label class="md-nav__link" for="__nav_3_4" id="__nav_3_4_label" tabindex="0">
          Operations
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_4_label" aria-expanded="true">
        <label class="md-nav__title" for="__nav_3_4">
          <span class="md-nav__icon md-icon"></span>
          Operations
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../multi-tenancy/" class="md-nav__link">
        Multi Tenancy
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          Security Best Practices
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        Security Best Practices
      </a>
      
        
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#pod-security" class="md-nav__link">
    Pod Security
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#rbac" class="md-nav__link">
    RBAC
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#network-policy" class="md-nav__link">
    Network Policy
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#policy-engine-best-practices" class="md-nav__link">
    Policy Engine Best Practices
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#regular-patches" class="md-nav__link">
    Regular Patches
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#verify-artefacts" class="md-nav__link">
    Verify Artefacts
  </a>
  
    <nav class="md-nav" aria-label="Verify Artefacts">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#verify-container-images" class="md-nav__link">
    Verify Container Images
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#verify-provenance" class="md-nav__link">
    Verify Provenance
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#fetching-sbom" class="md-nav__link">
    Fetching SBOM
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../v1beta1/" class="md-nav__link">
        Upgrading to v1beta1
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../using-latest-image/" class="md-nav__link">
        Using Latest Image
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../disable-cluster-features/" class="md-nav__link">
        Disable Cluster Features
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_4" >
      
      
        <label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
          Provider
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_4">
          <span class="md-nav__icon md-icon"></span>
          Provider
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../provider/aws-secrets-manager/" class="md-nav__link">
        AWS Secrets Manager
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/aws-parameter-store/" class="md-nav__link">
        AWS Parameter Store
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/azure-key-vault/" class="md-nav__link">
        Azure Key Vault
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/google-secrets-manager/" class="md-nav__link">
        Google Cloud Secret Manager
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/hashicorp-vault/" class="md-nav__link">
        HashiCorp Vault
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/kubernetes/" class="md-nav__link">
        Kubernetes
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/ibm-secrets-manager/" class="md-nav__link">
        IBM Secrets Manager
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/akeyless/" class="md-nav__link">
        Akeyless
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-certificate-manager/" class="md-nav__link">
        Yandex Certificate Manager
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-lockbox/" class="md-nav__link">
        Yandex Lockbox
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/alibaba/" class="md-nav__link">
        Alibaba Cloud
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/gitlab-variables/" class="md-nav__link">
        GitLab Variables
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/oracle-vault/" class="md-nav__link">
        Oracle Vault
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/1password-automation/" class="md-nav__link">
        1Password Secrets Automation
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/webhook/" class="md-nav__link">
        Webhook
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/fake/" class="md-nav__link">
        Fake
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/senhasegura-dsm/" class="md-nav__link">
        senhasegura DevOps Secrets Management (DSM)
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/doppler/" class="md-nav__link">
        Doppler
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/keeper-security/" class="md-nav__link">
        Keeper Security
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/scaleway/" class="md-nav__link">
        Scaleway
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_5" >
      
      
        <label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
          Examples
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_5">
          <span class="md-nav__icon md-icon"></span>
          Examples
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../examples/gitops-using-fluxcd/" class="md-nav__link">
        FluxCD
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/anchore-engine-credentials/" class="md-nav__link">
        Anchore Engine
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/jenkins-kubernetes-credentials/" class="md-nav__link">
        Jenkins
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/bitwarden/" class="md-nav__link">
        BitWarden
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6" >
      
      
        <label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
          Community
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_6">
          <span class="md-nav__icon md-icon"></span>
          Community
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_1" >
      
      
        <label class="md-nav__link" for="__nav_6_1" id="__nav_6_1_label" tabindex="0">
          Contributing
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_1_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_6_1">
          <span class="md-nav__icon md-icon"></span>
          Contributing
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../contributing/devguide/" class="md-nav__link">
        Developer guide
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/process/" class="md-nav__link">
        Contributing Process
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/release/" class="md-nav__link">
        Release Process
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/coc/" class="md-nav__link">
        Code of Conduct
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/roadmap/" class="md-nav__link">
        Roadmap
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
      
      <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_2" >
      
      
        <label class="md-nav__link" for="__nav_6_2" id="__nav_6_2_label" tabindex="0">
          External Resources
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_2_label" aria-expanded="false">
        <label class="md-nav__title" for="__nav_6_2">
          <span class="md-nav__icon md-icon"></span>
          External Resources
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
    <li class="md-nav__item">
      <a href="../../eso-talks/" class="md-nav__link">
        Talks
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-demos/" class="md-nav__link">
        Demos
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-blogs/" class="md-nav__link">
        Blogs
      </a>
    </li>
  

        </ul>
      </nav>
    </li>
  

        </ul>
      </nav>
    </li>
  

  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#pod-security" class="md-nav__link">
    Pod Security
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#rbac" class="md-nav__link">
    RBAC
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#network-policy" class="md-nav__link">
    Network Policy
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#policy-engine-best-practices" class="md-nav__link">
    Policy Engine Best Practices
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#regular-patches" class="md-nav__link">
    Regular Patches
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#verify-artefacts" class="md-nav__link">
    Verify Artefacts
  </a>
  
    <nav class="md-nav" aria-label="Verify Artefacts">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#verify-container-images" class="md-nav__link">
    Verify Container Images
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#verify-provenance" class="md-nav__link">
    Verify Provenance
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#fetching-sbom" class="md-nav__link">
    Fetching SBOM
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
                  </div>
                </div>
              </div>
            
          
            <div class="md-content" data-md-component="content">
              <article class="md-content__inner md-typeset">
                
                  
<h1 id="security-best-practices">Security Best Practices</h1>
<p>The purpose of this document is to provide a set of best practices for securing External Secrets Operator. These best practices are designed to reduce the risk of a successful attack against the operator or the Kubernetes cluster it integrates with.</p>
<h2 id="pod-security">Pod Security</h2>
<p>The External Secrets Operator Pods have been configured to adhere to <a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/">Pod Security Standards</a> <code>restricted</code> profile which establish a great security posture by following current Pod hardening best practices such as the <a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF">NSA Kubernetes Hardening Guide</a>.</p>
<p>These measures provide a secure and robust environment for the External Secrets Operator to operate within. They have been set as default since <code>v0.8.2</code> and should not be changed to conform with the principle of least privilege.</p>
<h2 id="rbac">RBAC</h2>
<p>The External Secrets Operator runs with highly privileged access to your Kubernetes cluster. Due to it's purpose it is able to read and write to all secrets across all namespaces.</p>
<p>Make sure to restrict access to ESO resources like <code>ExternalSecret</code>, <code>SecretStore</code> etc. where appropriate. This is particularly important for cluster-scoped resources like <code>ClusterExternalSecret</code> and <code>ClusterSecretStore</code>. If an attacker is able to tamper with these resources he could potentially get unauthorized access to secrets or may be able to exfiltrate data out of your system.</p>
<p>In most scenarios the External Secrets Operator runs cluster-wide. If this is not desired and you want to run it per-namespace, you can scope it to a particular namespace, see <code>scopedRBAC</code> and <code>scopedNamespace</code> in the helm chart.</p>
<p>A short checklist for you to walk through:</p>
<ul>
<li>restrict access to execute a shell <code>pods/exec</code> in External Secrets Operator Pod</li>
<li>restrict access to <code>(Cluster)ExternalSecret</code> and <code>(Cluster)SecretStore</code></li>
<li>restrict access to <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles">aggregated ClusterRoles</a> <code>view/edit/admin</code> where needed</li>
<li>run ESO with scoped RBAC/Namespace if needed</li>
</ul>
<h2 id="network-policy">Network Policy</h2>
<p>Network Traffic from/to the operator should be restricted using <code>NetworkPolicies</code> or similar. By default, External Secrets Operator does not provide Network Policies for you.</p>
<div class="admonition danger">
<p class="admonition-title">Data Exfiltration Risk</p>
<p>If not configured properly ESO may be used to exfiltrate data out of your cluster.
It is advised to create tight NetworkPolicies and use a policy engine such as kyverno to prevent data exfiltration.</p>
</div>
<p>You should restrict access in <strong>egress</strong> direction:</p>
<ul>
<li>controller<ul>
<li>kube-apiserver</li>
<li>secret provider (AWS, GCP, ...), where possible use private endpoints.</li>
</ul>
</li>
<li>webhook<ul>
<li>kube-apiserver</li>
</ul>
</li>
<li>cert-controller<ul>
<li>kube-apiserver</li>
</ul>
</li>
</ul>
<p>Further, you also should restrict <strong>ingress</strong> traffic to ESO Pods:</p>
<ul>
<li>controller<ul>
<li><code>:8080</code> from you monitoring agent</li>
</ul>
</li>
<li>cert-controller:<ul>
<li><code>:8080</code> from you monitoring agent</li>
<li><code>:8081</code> from kubelet (healthz/readyz)</li>
</ul>
</li>
<li>webhook:<ul>
<li><code>:10250</code> from the kube-apiserver</li>
<li><code>:8080</code> from you monitoring agent</li>
<li><code>:8081</code> from kubelet (healthz/readyz)</li>
</ul>
</li>
</ul>
<h2 id="policy-engine-best-practices">Policy Engine Best Practices</h2>
<p>You should use a policy engine like <a href="http://kyverno.io/">kyverno</a> or <a href="https://github.com/open-policy-agent/gatekeeper">OPA Gatekeeper</a> to restrict changes made to ESO resources like <code>SecretStore</code> and <code>ExternalSecret</code>.</p>
<div class="admonition danger">
<p class="admonition-title">Data Exfiltration Risk</p>
<p>ESO could be used to exfiltrate data out of your cluster. You should disable all providers you don't need.
Further, you should implement <code>NetworkPolicies</code> to restrict network access to known entities (see above), to prevent data exfiltration.</p>
</div>
<p>Here a couple of recommendations for you to consider:</p>
<ul>
<li>explicitly deny usage of the providers you don't need</li>
<li>restrict access to secrets with/without a particular prefix in <code>.spec.data[].remoteRef.key</code></li>
<li>restrict usage of a <code>(Cluster)SecretStore</code> reference in an ExternalSecret</li>
</ul>
<div class="admonition note">
<p class="admonition-title">Provider Validation Example Policy</p>
<p>The following policy validates the usage of the <code>provider</code> field in the SecretStore manifest.</p>
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">kyverno.io/v1</span>
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ClusterPolicy</span>
<span class="nt">metadata</span><span class="p">:</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">require-secretstore-aws-provider</span>
<span class="nt">spec</span><span class="p">:</span>
<span class="w">  </span><span class="nt">validationFailureAction</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Enforce</span>
<span class="w">  </span><span class="nt">rules</span><span class="p">:</span>
<span class="w">  </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">require-secretstore-aws-provider</span>
<span class="w">    </span><span class="nt">match</span><span class="p">:</span>
<span class="w">      </span><span class="nt">any</span><span class="p">:</span>
<span class="w">      </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">resources</span><span class="p">:</span>
<span class="w">          </span><span class="nt">kinds</span><span class="p">:</span>
<span class="w">          </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
<span class="w">          </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ClusterSecretStore</span>
<span class="w">    </span><span class="nt">validate</span><span class="p">:</span>
<span class="w">      </span><span class="nt">message</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;You</span><span class="nv"> </span><span class="s">must</span><span class="nv"> </span><span class="s">only</span><span class="nv"> </span><span class="s">use</span><span class="nv"> </span><span class="s">AWS</span><span class="nv"> </span><span class="s">SecretsManager&quot;</span>
<span class="w">      </span><span class="nt">pattern</span><span class="p">:</span>
<span class="w">        </span><span class="nt">spec</span><span class="p">:</span>
<span class="w">          </span><span class="nt">provider</span><span class="p">:</span>
<span class="w">            </span><span class="nt">aws</span><span class="p">:</span>
<span class="w">              </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
</code></pre></div>
</div>
<h2 id="regular-patches">Regular Patches</h2>
<p>Regularly patch and update all software components of ESO and the cluster to ensure that known vulnerabilities are addressed. Use automated patching and updating tools to ensure that all components are kept up-to-date.</p>
<p>We provide regular updates to ESO, see <a href="../../introduction/stability-support.md">Stability and Support</a>.</p>
<h2 id="verify-artefacts">Verify Artefacts</h2>
<h3 id="verify-container-images">Verify Container Images</h3>
<p>External Secrets Operator container images are signed using Cosign and the keyless signing feature. To verify the container image, follow the steps below.</p>
<div class="highlight"><pre><span></span><code>$<span class="w"> </span>crane<span class="w"> </span>digest<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1
sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554

$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify<span class="w"> </span>ghcr.io/external-secrets/external-secrets@sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq

<span class="c1"># ...</span>
<span class="o">[</span>
<span class="w">  </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;critical&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;identity&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;docker-reference&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;image&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;docker-manifest-digest&quot;</span>:<span class="w"> </span><span class="s2">&quot;sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;type&quot;</span>:<span class="w"> </span><span class="s2">&quot;cosign container image signature&quot;</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="s2">&quot;optional&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.1&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://token.actions.githubusercontent.com&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.2&quot;</span>:<span class="w"> </span><span class="s2">&quot;workflow_dispatch&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.3&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.4&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.5&quot;</span>:<span class="w"> </span><span class="s2">&quot;external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.6&quot;</span>:<span class="w"> </span><span class="s2">&quot;refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Bundle&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="c1"># ...</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;GITHUB_ACTOR&quot;</span>:<span class="w"> </span><span class="s2">&quot;gusfcarvalho&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Issuer&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://token.actions.githubusercontent.com&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Subject&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowName&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowRef&quot;</span>:<span class="w"> </span><span class="s2">&quot;refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowRepository&quot;</span>:<span class="w"> </span><span class="s2">&quot;external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowSha&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowTrigger&quot;</span>:<span class="w"> </span><span class="s2">&quot;workflow_dispatch&quot;</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">}</span>
<span class="o">]</span>
</code></pre></div>
<p>Note that the important fields to verify in the output are <code>optional.Issuer</code> and <code>optional.Subject</code>. If Issuer and Subject do not match the values shown above, the image is not legit and should not be used.</p>
<h3 id="verify-provenance">Verify Provenance</h3>
<p>External Secrets Operator creates and attests to the provenance of its builds using the <a href="https://slsa.dev/provenance/v0.1">SLSA standard</a>. The attested provenance may be verified using the cosign tool.</p>
<div class="highlight"><pre><span></span><code>$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify-attestation<span class="w"> </span>--type<span class="w"> </span>slsaprovenance<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span>.payload<span class="w"> </span>-r<span class="w"> </span><span class="p">|</span><span class="w"> </span>base64<span class="w"> </span>--decode<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq

Verification<span class="w"> </span><span class="k">for</span><span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1<span class="w"> </span>--
The<span class="w"> </span>following<span class="w"> </span>checks<span class="w"> </span>were<span class="w"> </span>performed<span class="w"> </span>on<span class="w"> </span>each<span class="w"> </span>of<span class="w"> </span>these<span class="w"> </span>signatures:
<span class="w">  </span>-<span class="w"> </span>The<span class="w"> </span>cosign<span class="w"> </span>claims<span class="w"> </span>were<span class="w"> </span>validated
<span class="w">  </span>-<span class="w"> </span>Existence<span class="w"> </span>of<span class="w"> </span>the<span class="w"> </span>claims<span class="w"> </span><span class="k">in</span><span class="w"> </span>the<span class="w"> </span>transparency<span class="w"> </span>log<span class="w"> </span>was<span class="w"> </span>verified<span class="w"> </span>offline
<span class="w">  </span>-<span class="w"> </span>Any<span class="w"> </span>certificates<span class="w"> </span>were<span class="w"> </span>verified<span class="w"> </span>against<span class="w"> </span>the<span class="w"> </span>Fulcio<span class="w"> </span>roots.
Certificate<span class="w"> </span>subject:<span class="w">  </span>https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main
Certificate<span class="w"> </span>issuer<span class="w"> </span>URL:<span class="w">  </span>https://token.actions.githubusercontent.com
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Trigger:<span class="w"> </span>workflow_dispatch
GitHub<span class="w"> </span>Workflow<span class="w"> </span>SHA:<span class="w"> </span>a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Name:<span class="w"> </span>Create<span class="w"> </span>Release
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Trigger<span class="w"> </span>external-secrets/external-secrets
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Ref:<span class="w"> </span>refs/heads/main
<span class="o">{</span>
<span class="w">  </span><span class="s2">&quot;_type&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://in-toto.io/Statement/v0.1&quot;</span>,
<span class="w">  </span><span class="s2">&quot;predicateType&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://slsa.dev/provenance/v0.2&quot;</span>,
<span class="w">  </span><span class="s2">&quot;subject&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">    </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;digest&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;sha256&quot;</span>:<span class="w"> </span><span class="s2">&quot;36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>
<span class="w">      </span><span class="o">}</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">]</span>,
<span class="w">  </span><span class="s2">&quot;predicate&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;builder&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;id&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/external-secrets/external-secrets/Attestations/GitHubHostedActions@v1&quot;</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="s2">&quot;buildType&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/Attestations/GitHubActionsWorkflow@v1&quot;</span>,
<span class="w">    </span><span class="s2">&quot;invocation&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;configSource&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;uri&quot;</span>:<span class="w"> </span><span class="s2">&quot;git+https://github.com/external-secrets/external-secrets&quot;</span>,
<span class="w">        </span><span class="s2">&quot;digest&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;sha1&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>
<span class="w">        </span><span class="o">}</span>,
<span class="w">        </span><span class="s2">&quot;entryPoint&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;parameters&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;version&quot;</span>:<span class="w"> </span><span class="s2">&quot;v0.8.1&quot;</span>
<span class="w">      </span><span class="o">}</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="o">[</span>...<span class="o">]</span>
<span class="w">  </span><span class="o">}</span>
<span class="o">}</span>
</code></pre></div>
<h3 id="fetching-sbom">Fetching SBOM</h3>
<p>An SBOM (Software Bill of Materials) in Software Package Data Exchange (SPDX) JSON format is attached to every External Secrets Operator image.  To download and verify the SBOM for a specific version, install Cosign and run:</p>
<div class="highlight"><pre><span></span><code>$<span class="w"> </span>crane<span class="w"> </span>digest<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1
sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554

$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify-attestation<span class="w"> </span>--type<span class="w"> </span>spdx<span class="w"> </span>ghcr.io/external-secrets/external-secrets@sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span><span class="s1">&#39;.payload |= @base64d | .payload | fromjson&#39;</span><span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span><span class="s1">&#39;.predicate.Data | fromjson&#39;</span>

<span class="o">[</span>...<span class="o">]</span>
<span class="o">{</span>
<span class="w">  </span><span class="s2">&quot;SPDXID&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDXRef-DOCUMENT&quot;</span>,
<span class="w">  </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets@sha256-36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>,
<span class="w">  </span><span class="s2">&quot;spdxVersion&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDX-2.2&quot;</span>,
<span class="w">  </span><span class="s2">&quot;creationInfo&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;created&quot;</span>:<span class="w"> </span><span class="s2">&quot;2023-03-17T23:17:01.568002344Z&quot;</span>,
<span class="w">    </span><span class="s2">&quot;creators&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">      </span><span class="s2">&quot;Organization: Anchore, Inc&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Tool: syft-0.40.1&quot;</span>
<span class="w">    </span><span class="o">]</span>,
<span class="w">    </span><span class="s2">&quot;licenseListVersion&quot;</span>:<span class="w"> </span><span class="s2">&quot;3.16&quot;</span>
<span class="w">  </span><span class="o">}</span>,
<span class="w">  </span><span class="s2">&quot;dataLicense&quot;</span>:<span class="w"> </span><span class="s2">&quot;CC0-1.0&quot;</span>,
<span class="w">  </span><span class="s2">&quot;documentNamespace&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://anchore.com/syft/image/ghcr.io/external-secrets/external-secrets@sha256-36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554-83484ebb-b469-45fa-8fcc-9290c4ea4f6f&quot;</span>,
<span class="w">  </span><span class="s2">&quot;packages&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">    </span><span class="o">[</span>...<span class="o">]</span>
<span class="w">    </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;SPDXID&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDXRef-c809070b0beb099e&quot;</span>,
<span class="w">      </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;tzdata&quot;</span>,
<span class="w">      </span><span class="s2">&quot;licenseConcluded&quot;</span>:<span class="w"> </span><span class="s2">&quot;NONE&quot;</span>,
<span class="w">      </span><span class="s2">&quot;downloadLocation&quot;</span>:<span class="w"> </span><span class="s2">&quot;NOASSERTION&quot;</span>,
<span class="w">      </span><span class="s2">&quot;externalRefs&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">        </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;referenceCategory&quot;</span>:<span class="w"> </span><span class="s2">&quot;SECURITY&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceLocator&quot;</span>:<span class="w"> </span><span class="s2">&quot;cpe:2.3:a:tzdata:tzdata:2021a-1\\+deb11u8:*:*:*:*:*:*:*&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceType&quot;</span>:<span class="w"> </span><span class="s2">&quot;cpe23Type&quot;</span>
<span class="w">        </span><span class="o">}</span>,
<span class="w">        </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;referenceCategory&quot;</span>:<span class="w"> </span><span class="s2">&quot;PACKAGE_MANAGER&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceLocator&quot;</span>:<span class="w"> </span><span class="s2">&quot;pkg:deb/debian/tzdata@2021a-1+deb11u8?arch=all&amp;distro=debian-11&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceType&quot;</span>:<span class="w"> </span><span class="s2">&quot;purl&quot;</span>
<span class="w">        </span><span class="o">}</span>
<span class="w">      </span><span class="o">]</span>,
<span class="w">      </span><span class="s2">&quot;filesAnalyzed&quot;</span>:<span class="w"> </span>false,
<span class="w">      </span><span class="s2">&quot;licenseDeclared&quot;</span>:<span class="w"> </span><span class="s2">&quot;NONE&quot;</span>,
<span class="w">      </span><span class="s2">&quot;originator&quot;</span>:<span class="w"> </span><span class="s2">&quot;Person: GNU Libc Maintainers &lt;debian-glibc@lists.debian.org&gt;&quot;</span>,
<span class="w">      </span><span class="s2">&quot;sourceInfo&quot;</span>:<span class="w"> </span><span class="s2">&quot;acquired package info from DPKG DB: /var/lib/dpkg/status.d/tzdata, /usr/share/doc/tzdata/copyright&quot;</span>,
<span class="w">      </span><span class="s2">&quot;versionInfo&quot;</span>:<span class="w"> </span><span class="s2">&quot;2021a-1+deb11u8&quot;</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">]</span>
<span class="o">}</span>
</code></pre></div>


              </article>
            </div>
          
          
        </div>
        
      </main>
      
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      &copy; 2023 The external-secrets Authors.<br/>
&copy; 2023 The Linux Foundation. All rights reserved.<br/><br/>
The Linux Foundation has registered trademarks and uses trademarks.<br/>
For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage/">Trademark Usage page</a>.

    </div>
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.tabs", "navigation.indexes", "navigation.expand"], "search": "../../assets/javascripts/workers/search.208ed371.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"provider": "mike"}}</script>
    
    
      <script src="../../assets/javascripts/bundle.fac441b0.min.js"></script>
      
    
  </body>
</html>