logic855
/
helm-external-secrets
mirrorاز https://github.com/external-secrets/external-secrets


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024602560266027602860296030603160326033603460356036603760386039604060416042604360446045604660476048604960506051605260536054605560566057605860596060606160626063606460656066606760686069607060716072607360746075607660776078607960806081608260836084608560866087608860896090609160926093609460956096609760986099610061016102610361046105610661076108610961106111611261136114611561166117611861196120
							
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
        <link rel="prev" href="../multi-tenancy/">
      
      
        <link rel="next" href="../threat-model/">
      
      
      <link rel="icon" href="../../pictures/eso-round-logo.svg">
      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.7">
    
    
        <title>Security Best Practices - External Secrets Operator</title>
      
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.ec1eaa64.min.css">
      
        
        <link rel="stylesheet" href="../../assets/stylesheets/palette.ab4e12ef.min.css">
      
      
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    <script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      
<script id="__analytics">function __md_analytics(){function e(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],e("js",new Date),e("config","G-QP38TD8K7V"),document.addEventListener("DOMContentLoaded",(function(){document.forms.search&&document.forms.search.query.addEventListener("blur",(function(){this.value&&e("event","search",{search_term:this.value})}));document$.subscribe((function(){var t=document.forms.feedback;if(void 0!==t)for(var a of t.querySelectorAll("[type=submit]"))a.addEventListener("click",(function(a){a.preventDefault();var n=document.location.pathname,d=this.getAttribute("data-md-value");e("event","feedback",{page:n,data:d}),t.firstElementChild.disabled=!0;var r=t.querySelector(".md-feedback__note [data-md-value='"+d+"']");r&&(r.hidden=!1)})),t.hidden=!1})),location$.subscribe((function(t){e("config","G-QP38TD8K7V",{page_path:t.pathname})}))}));var t=document.createElement("script");t.async=!0,t.src="https://www.googletagmanager.com/gtag/js?id=G-QP38TD8K7V",document.getElementById("__analytics").insertAdjacentElement("afterEnd",t)}</script>
  
    <script>"undefined"!=typeof __md_analytics&&__md_analytics()</script>
  

  </head>
  
  
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
  
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#security-best-practices" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-color-scheme="default" data-md-component="outdated" hidden>
        
          <aside class="md-banner md-banner--warning">
            <div class="md-banner__inner md-grid md-typeset">
              
  You're not viewing the latest version.
  <a href="../../..">
    <strong>Click here to go to latest.</strong>
  </a>

            </div>
            <script>var el=document.querySelector("[data-md-component=outdated]"),base=new URL("../.."),outdated=__md_get("__outdated",sessionStorage,base);!0===outdated&&el&&(el.hidden=!1)</script>
          </aside>
        
      </div>
    
    
<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../.." title="External Secrets Operator" class="md-header__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  <img src="../../pictures/eso-round-logo.svg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            External Secrets Operator
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              Security Best Practices
            
          </span>
        </div>
      </div>
    </div>
    
      
        <form class="md-header__option" data-md-component="palette">
  
    
    <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo"  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_0">
    
      <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
      </label>
    
  
    <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="indigo"  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_1">
    
      <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
      </label>
    
  
</form>
      
    
      <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
    
    
        <label class="md-header__button md-icon" for="__search">
          
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
        </label>
        <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
          
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
        </button>
      </nav>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list" role="presentation"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
      
    
      <div class="md-header__source">
        <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
      </div>
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-grid">
    <ul class="md-tabs__list">
      
        
      <li class="md-tabs__item">
        <a href="../.." class="md-tabs__link">
          
  
  Introduction

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../api/components/" class="md-tabs__link">
          
  
  API

        </a>
      </li>
    
  
      <li class="md-tabs__item md-tabs__item--active">
        <a href="../introduction/" class="md-tabs__link">
          
  
  Guides

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../provider/aws-secrets-manager/" class="md-tabs__link">
          
  
  Provider

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../examples/gitops-using-fluxcd/" class="md-tabs__link">
          
  
  Examples

        </a>
      </li>
    
  
      <li class="md-tabs__item">
        <a href="../../contributing/devguide/" class="md-tabs__link">
          
  
  Community

        </a>
      </li>
    
  
    </ul>
  </div>
</nav>
          
        
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../.." title="External Secrets Operator" class="md-nav__button md-logo" aria-label="External Secrets Operator" data-md-component="logo">
      
  <img src="../../pictures/eso-round-logo.svg" alt="logo">

    </a>
    External Secrets Operator
  </label>
  
    <div class="md-nav__source">
      <a href="https://github.com/external-secrets/external-secrets" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
  </div>
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_1" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../.." class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    
  
    Introduction
  

  </span>
  
  
            </a>
            
              
              <label class="md-nav__link " for="__nav_1" id="__nav_1_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_1">
            <span class="md-nav__icon md-icon"></span>
            
  
    Introduction
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../introduction/overview/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Overview
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/glossary/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Glossary
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/prerequisites/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Prerequisites
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/getting-started/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Getting started
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/faq/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    FAQ
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/stability-support/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Stability and Support
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../introduction/deprecation-policy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Deprecation Policy
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2" >
        
          
          <label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    API
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    API
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/components/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Components
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_2" >
        
          
          <label class="md-nav__link" for="__nav_2_2" id="__nav_2_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Core Resources
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    Core Resources
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/externalsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    ExternalSecret
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/secretstore/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    SecretStore
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clustersecretstore/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    ClusterSecretStore
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clusterexternalsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    ClusterExternalSecret
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/clusterpushsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    ClusterPushSecret
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/pushsecret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    PushSecret
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_3" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../api/generator/" class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    
  
    Generators
  

  </span>
  
  
            </a>
            
              
              <label class="md-nav__link " for="__nav_2_3" id="__nav_2_3_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_3">
            <span class="md-nav__icon md-icon"></span>
            
  
    Generators
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/generator/acr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Azure Container Registry
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/ecr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS Elastic Container Registry
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/sts/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS STS Session Token
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/cloudsmith/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Cloudsmith
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/cluster/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Cluster Generator
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/gcr/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Google Container Registry
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/grafana/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Grafana
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/quay/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Quay
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Vault Dynamic Secret
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/beyondtrustworkloadcredentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    BeyondTrust Workload Credentials
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/password/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Password
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/fake/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Fake
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/webhook/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Webhook
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/github/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Github
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/gitlab/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Gitlab
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/uuid/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    UUID
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/mfa/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    MFA
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/generator/sshkey/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    SSHKey
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_2_4" >
        
          
          <label class="md-nav__link" for="__nav_2_4" id="__nav_2_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Reference Docs
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_4">
            <span class="md-nav__icon md-icon"></span>
            
  
    Reference Docs
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../api/spec/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    API specification
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/controller-options/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Controller Options
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/metrics/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Metrics
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../api/selectable-fields/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Selectable Fields
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" checked>
        
          
          <label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="">
            
  
  <span class="md-ellipsis">
    
  
    Guides
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3">
            <span class="md-nav__icon md-icon"></span>
            
  
    Guides
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../introduction/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Introduction
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2" >
        
          
          <label class="md-nav__link" for="__nav_3_2" id="__nav_3_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    External Secrets
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    External Secrets
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../all-keys-one-secret/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Extract structured data
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../getallsecrets/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Find Secrets by Name or Metadata
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../datafrom-rewrite/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Rewriting Keys
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_2_4" >
        
          
          <label class="md-nav__link" for="__nav_3_2_4" id="__nav_3_2_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Advanced Templating
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_3_2_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_2_4">
            <span class="md-nav__icon md-icon"></span>
            
  
    Advanced Templating
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../templating/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    v2
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../templating-v1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    v1
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../common-k8s-secret-types/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Kubernetes Secret Types
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../ownership-deletion-policy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Lifecycle: ownership & deletion
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../decoding-strategy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Decoding Strategies
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../controller-class/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Controller Classes
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../targeting-custom-resources/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Targeting Custom Resources
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../generator/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Generators
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../pushsecrets/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Push Secrets
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_6" checked>
        
          
          <label class="md-nav__link" for="__nav_3_6" id="__nav_3_6_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Operations
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_6_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3_6">
            <span class="md-nav__icon md-icon"></span>
            
  
    Operations
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../multi-tenancy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Multi Tenancy
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          
  
  <span class="md-ellipsis">
    
  
    Security Best Practices
  

  </span>
  
  
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  <span class="md-ellipsis">
    
  
    Security Best Practices
  

  </span>
  
  
      </a>
      
        
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#security-functions-and-features" class="md-nav__link">
    <span class="md-ellipsis">
      
        Security Functions and Features
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Security Functions and Features">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#1-namespace-isolation" class="md-nav__link">
    <span class="md-ellipsis">
      
        1. Namespace Isolation
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#2-configure-clustersecretstore-match-conditions" class="md-nav__link">
    <span class="md-ellipsis">
      
        2. Configure ClusterSecretStore match conditions
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#3-selectively-disable-reconciliation-of-resources" class="md-nav__link">
    <span class="md-ellipsis">
      
        3. Selectively Disable Reconciliation of Resources
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#4-implement-namespace-scoped-installation" class="md-nav__link">
    <span class="md-ellipsis">
      
        4. Implement Namespace-Scoped Installation
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#5-restrict-webhook-tls-ciphers" class="md-nav__link">
    <span class="md-ellipsis">
      
        5. Restrict Webhook TLS Ciphers
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#6-harden-the-helm-chart" class="md-nav__link">
    <span class="md-ellipsis">
      
        6. Harden the Helm Chart
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#pod-security" class="md-nav__link">
    <span class="md-ellipsis">
      
        Pod Security
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#role-based-access-control-rbac" class="md-nav__link">
    <span class="md-ellipsis">
      
        Role-Based Access Control (RBAC)
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Role-Based Access Control (RBAC)">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#scoping-serviceaccount-token-creation" class="md-nav__link">
    <span class="md-ellipsis">
      
        Scoping ServiceAccount Token Creation
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#network-traffic-and-security" class="md-nav__link">
    <span class="md-ellipsis">
      
        Network Traffic and Security
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Network Traffic and Security">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#outbound-traffic-restrictions" class="md-nav__link">
    <span class="md-ellipsis">
      
        Outbound Traffic Restrictions
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Outbound Traffic Restrictions">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#core-controller" class="md-nav__link">
    <span class="md-ellipsis">
      
        Core Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#webhook" class="md-nav__link">
    <span class="md-ellipsis">
      
        Webhook
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#cert-controller" class="md-nav__link">
    <span class="md-ellipsis">
      
        Cert Controller
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#inbound-traffic-restrictions" class="md-nav__link">
    <span class="md-ellipsis">
      
        Inbound Traffic Restrictions
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Inbound Traffic Restrictions">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#core-controller_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Core Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#cert-controller_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Cert Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#webhook_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Webhook
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#policy-engine-best-practices" class="md-nav__link">
    <span class="md-ellipsis">
      
        Policy Engine Best Practices
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#regular-patches" class="md-nav__link">
    <span class="md-ellipsis">
      
        Regular Patches
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#verify-artefacts" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verify Artefacts
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Verify Artefacts">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#verify-container-images" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verify Container Images
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#verifying-provenance" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verifying Provenance
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#fetching-sbom" class="md-nav__link">
    <span class="md-ellipsis">
      
        Fetching SBOM
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
      
    </li>
  

    <li class="md-nav__item">
      <a href="../threat-model/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Threat Model
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../v1beta1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Upgrading to v1beta1
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../using-latest-image/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Using Latest Image
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../disable-cluster-features/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Disable Cluster Features
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_3_7" >
        
          
          <label class="md-nav__link" for="__nav_3_7" id="__nav_3_7_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Tooling
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_7_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_7">
            <span class="md-nav__icon md-icon"></span>
            
  
    Tooling
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../using-esoctl-tool/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Using the esoctl tool
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_4" >
        
          
          <label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Provider
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4">
            <span class="md-nav__icon md-icon"></span>
            
  
    Provider
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../provider/aws-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS Secrets Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/aws-parameter-store/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS Parameter Store
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/aws-certificate-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS Certificate Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/aws-access/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    AWS Access
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/azure-key-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Azure Key Vault
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/barbican/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Barbican
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/beyondtrust/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    BeyondTrust
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/beyondtrustworkloadcredentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    BeyondTrust Workload Credentials
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/bitwarden-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Bitwarden Secrets Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/chef/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Chef
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/cloudru/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Cloud.ru Secret Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/conjur/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    CyberArk Conjur
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/google-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Google Cloud Secret Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/hashicorp-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    HashiCorp Vault
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/kubernetes/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Kubernetes
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/crd/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Kubernetes CRD
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/ibm-secrets-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    IBM Secrets Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/akeyless/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Akeyless
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-certificate-manager/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Yandex Certificate Manager
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/yandex-lockbox/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Yandex Lockbox
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/gitlab-variables/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    GitLab Variables
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/github/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Github Actions Secrets
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/oracle-vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Oracle Vault
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/ovhcloud/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    OVHcloud
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/1password-automation/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    1Password Connect Server
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/1password-sdk/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    1Password SDK
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/webhook/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Webhook
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/fake/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Fake
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/senhasegura-dsm/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    senhasegura DevOps Secrets Management (DSM)
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/doppler/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Doppler
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/keeper-security/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Keeper Security
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/cloak/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Cloak End 2 End Encrypted Secrets
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/scaleway/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Scaleway
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/delinea/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Delinea
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/secretserver/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Secret Server
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/passbolt/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Passbolt
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/pulumi/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Pulumi ESC
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/onboardbase/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Onboardbase
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider-passworddepot/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Password Depot
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/fortanix/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Fortanix
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/infisical/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Infisical
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/previder/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Previder
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/openbao/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    OpenBao
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/volcengine/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Volcengine
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/ngrok/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    ngrok
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/devolutions-server/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Devolutions Server
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../provider/nebius-mysterybox/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Nebius MysteryBox
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_5" >
        
          
          <label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Examples
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_5">
            <span class="md-nav__icon md-icon"></span>
            
  
    Examples
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../examples/gitops-using-fluxcd/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    FluxCD
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/anchore-engine-credentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Anchore Engine
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/jenkins-kubernetes-credentials/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Jenkins
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../examples/bitwarden/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Bitwarden
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6" >
        
          
          <label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Community
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6">
            <span class="md-nav__icon md-icon"></span>
            
  
    Community
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_1" >
        
          
          <label class="md-nav__link" for="__nav_6_1" id="__nav_6_1_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    Contributing
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6_1">
            <span class="md-nav__icon md-icon"></span>
            
  
    Contributing
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../contributing/devguide/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Developer guide
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/process/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Contributing Process
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/release/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Release Process
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/coc/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Code of Conduct
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/calendar/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Community meetings calendar
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/roadmap/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Roadmap
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/burnout-mitigation/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Burnout Prevention
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../contributing/llm-policy/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    LLM Policy
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

    <li class="md-nav__item md-nav__item--nested">
      
        
        <input class="md-nav__toggle md-toggle md-toggle--indeterminate" type="checkbox" id="__nav_6_2" >
        
          
          <label class="md-nav__link" for="__nav_6_2" id="__nav_6_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    
  
    External Resources
  

  </span>
  
  
            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    External Resources
  

          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
    <li class="md-nav__item">
      <a href="../../eso-talks/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Talks
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-demos/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Demos
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-blogs/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Blogs
  

  </span>
  
  
      </a>
    </li>
  

    <li class="md-nav__item">
      <a href="../../eso-tools/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    
  
    Tools
  

  </span>
  
  
      </a>
    </li>
  

          </ul>
        </nav>
      
    </li>
  

          </ul>
        </nav>
      
    </li>
  

  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#security-functions-and-features" class="md-nav__link">
    <span class="md-ellipsis">
      
        Security Functions and Features
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Security Functions and Features">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#1-namespace-isolation" class="md-nav__link">
    <span class="md-ellipsis">
      
        1. Namespace Isolation
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#2-configure-clustersecretstore-match-conditions" class="md-nav__link">
    <span class="md-ellipsis">
      
        2. Configure ClusterSecretStore match conditions
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#3-selectively-disable-reconciliation-of-resources" class="md-nav__link">
    <span class="md-ellipsis">
      
        3. Selectively Disable Reconciliation of Resources
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#4-implement-namespace-scoped-installation" class="md-nav__link">
    <span class="md-ellipsis">
      
        4. Implement Namespace-Scoped Installation
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#5-restrict-webhook-tls-ciphers" class="md-nav__link">
    <span class="md-ellipsis">
      
        5. Restrict Webhook TLS Ciphers
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#6-harden-the-helm-chart" class="md-nav__link">
    <span class="md-ellipsis">
      
        6. Harden the Helm Chart
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#pod-security" class="md-nav__link">
    <span class="md-ellipsis">
      
        Pod Security
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#role-based-access-control-rbac" class="md-nav__link">
    <span class="md-ellipsis">
      
        Role-Based Access Control (RBAC)
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Role-Based Access Control (RBAC)">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#scoping-serviceaccount-token-creation" class="md-nav__link">
    <span class="md-ellipsis">
      
        Scoping ServiceAccount Token Creation
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#network-traffic-and-security" class="md-nav__link">
    <span class="md-ellipsis">
      
        Network Traffic and Security
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Network Traffic and Security">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#outbound-traffic-restrictions" class="md-nav__link">
    <span class="md-ellipsis">
      
        Outbound Traffic Restrictions
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Outbound Traffic Restrictions">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#core-controller" class="md-nav__link">
    <span class="md-ellipsis">
      
        Core Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#webhook" class="md-nav__link">
    <span class="md-ellipsis">
      
        Webhook
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#cert-controller" class="md-nav__link">
    <span class="md-ellipsis">
      
        Cert Controller
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
          <li class="md-nav__item">
  <a href="#inbound-traffic-restrictions" class="md-nav__link">
    <span class="md-ellipsis">
      
        Inbound Traffic Restrictions
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Inbound Traffic Restrictions">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#core-controller_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Core Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#cert-controller_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Cert Controller
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#webhook_1" class="md-nav__link">
    <span class="md-ellipsis">
      
        Webhook
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#policy-engine-best-practices" class="md-nav__link">
    <span class="md-ellipsis">
      
        Policy Engine Best Practices
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#regular-patches" class="md-nav__link">
    <span class="md-ellipsis">
      
        Regular Patches
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#verify-artefacts" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verify Artefacts
      
    </span>
  </a>
  
    <nav class="md-nav" aria-label="Verify Artefacts">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#verify-container-images" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verify Container Images
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#verifying-provenance" class="md-nav__link">
    <span class="md-ellipsis">
      
        Verifying Provenance
      
    </span>
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#fetching-sbom" class="md-nav__link">
    <span class="md-ellipsis">
      
        Fetching SBOM
      
    </span>
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
    </ul>
  
</nav>
                  </div>
                </div>
              </div>
            
          
            <div class="md-content" data-md-component="content">
              
              <article class="md-content__inner md-typeset">
                
                  
<h1 id="security-best-practices">Security Best Practices</h1>
<p>The purpose of this document is to outline a set of best practices for securing the External Secrets Operator (ESO). These practices aim to mitigate the risk of successful attacks against ESO and the Kubernetes cluster it integrates with.</p>
<h2 id="security-functions-and-features">Security Functions and Features</h2>
<h3 id="1-namespace-isolation">1. Namespace Isolation</h3>
<p>To maintain security boundaries, ESO ensures that namespaced resources like <code>SecretStore</code> and <code>ExternalSecret</code> are limited to their respective namespaces. The following rules apply:</p>
<ol>
<li><code>ExternalSecret</code> resources must not have cross-namespace references of <code>Kind=SecretStore</code> or <code>Kind=Secret</code> resources</li>
<li><code>SecretStore</code> resources must not have cross-namespace references of <code>Kind=Secret</code> or others</li>
</ol>
<p>For cluster-wide resources like <code>ClusterSecretStore</code> and <code>ClusterExternalSecret</code>, exercise caution since they have access to Secret resources across all namespaces. Minimize RBAC permissions for administrators and developers to the necessary minimum. If cluster-wide resources are not required, it is recommended to disable them.</p>
<h3 id="2-configure-clustersecretstore-match-conditions">2. Configure ClusterSecretStore match conditions</h3>
<p>Utilize the ClusterSecretStore resource to define specific match conditions using <code>namespaceSelector</code> or an explicit namespaces list. This restricts the usage of the <code>ClusterSecretStore</code> to a predetermined list of namespaces or a namespace that matches a predefined label. Here's an example:</p>
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ClusterSecretStore</span>
<span class="nt">metadata</span><span class="p">:</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">fake</span>
<span class="nt">spec</span><span class="p">:</span>
<span class="w">  </span><span class="nt">conditions</span><span class="p">:</span>
<span class="w">    </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">namespaceSelector</span><span class="p">:</span>
<span class="w">        </span><span class="nt">matchLabels</span><span class="p">:</span>
<span class="w">          </span><span class="nt">app</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">frontend</span>
</code></pre></div>
<h3 id="3-selectively-disable-reconciliation-of-resources">3. Selectively Disable Reconciliation of Resources</h3>
<p>ESO allows you to selectively disable the reconciliation of resources. You can disable reconciliation for:</p>
<ul>
<li><strong>Cluster-wide resources</strong>: <code>ClusterSecretStore</code>, <code>ClusterExternalSecret</code></li>
<li><strong>Namespaced resources</strong>: <code>SecretStore</code>, <code>PushSecret</code></li>
</ul>
<p>You can disable the installation of CRDs and reconciliation in the Helm chart, or disable reconciliation in the core controller.</p>
<p>To disable reconciliation in the Helm chart:</p>
<div class="highlight"><pre><span></span><code><span class="nt">processClusterExternalSecret</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="nt">processClusterStore</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="nt">processPushSecret</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="nt">processSecretStore</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
</code></pre></div>
<p>To disable CRD installation in the Helm chart:</p>
<div class="highlight"><pre><span></span><code><span class="nt">crds</span><span class="p">:</span>
<span class="w">  </span><span class="nt">createClusterExternalSecret</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="w">  </span><span class="nt">createClusterSecretStore</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="w">  </span><span class="nt">createSecretStore</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
<span class="w">  </span><span class="nt">createPushSecret</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
</code></pre></div>
<p><strong>Warning:</strong> Disabling the <code>SecretStore</code> CRD will prevent ExternalSecrets from referencing namespaced SecretStores. Only use this if you exclusively use ClusterSecretStore.</p>
<p>Note that disabling CRD installation for a resource does not automatically disable its reconciliation.
The core controller will issue error logs if the CRD is not installed but the reconciliation is not disabled.</p>
<p>To disable reconciliation in the core controller, set the following flags:</p>
<div class="highlight"><pre><span></span><code>--enable-cluster-external-secret-reconciler=false
--enable-cluster-store-reconciler=false
--enable-secret-store-reconciler=false
--enable-push-secret-reconciler=false
</code></pre></div>
<h3 id="4-implement-namespace-scoped-installation">4. Implement Namespace-Scoped Installation</h3>
<p>To further enhance security, consider installing ESO into a specific namespace with restricted access to only that namespace's resources. This prevents access to cluster-wide secrets. Use the following Helm values to scope the controller to a specific namespace:</p>
<div class="highlight"><pre><span></span><code><span class="c1"># If set to true, create scoped RBAC roles under the scoped namespace</span>
<span class="c1"># and implicitly disable cluster stores and cluster external secrets</span>
<span class="nt">scopedRBAC</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>

<span class="c1"># Specify the namespace where external secrets should be reconciled</span>
<span class="nt">scopedNamespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">my-namespace</span>
</code></pre></div>
<h3 id="5-restrict-webhook-tls-ciphers">5. Restrict Webhook TLS Ciphers</h3>
<p>Consider installing ESO restricting webhook ciphers. Use the following Helm values to scope webhook for specific TLS ciphers:
<div class="highlight"><pre><span></span><code><span class="nt">webhook</span><span class="p">:</span>
<span class="w">  </span><span class="nt">extraArgs</span><span class="p">:</span>
<span class="w">    </span><span class="nt">tls-ciphers</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256&quot;</span>
</code></pre></div></p>
<h3 id="6-harden-the-helm-chart">6. Harden the Helm Chart</h3>
<p>The provided Helm chart is designed for ease of use and may not meet your organization's specific security requirements out-of-the-box. It is crucial to review the default Helm chart values and harden the configuration. Any misconfiguration caused by using the provided helm charts is not covered by our support policy - even if it leads to a security incident.</p>
<p>Here are some examples of how you can harden the Helm chart:</p>
<ul>
<li>
<p><strong>Scope RBAC Permissions</strong>: The default chart grants permissions to create service account tokens for any service account. You can disable this by setting <code>rbac.serviceAccountTokenCreate: false</code>. When disabled, you must grant ESO token creation for specific ServiceAccounts via dedicated Role/RoleBinding with a <code>resourceNames</code> constraint. This limits the operator's ability to impersonate other service accounts.</p>
</li>
<li>
<p><strong>Use Tightly Scoped Deployments</strong>: If you don't need certain features, disable them. For example, you can prevent the injection of sidecar containers by using a custom appArmor profile, or an admission controller like Kyverno to enforce restrictions on your deployment.</p>
</li>
<li>
<p><strong>Use it as a Dependency</strong>: Instead of deploying the chart directly, you can use it as a dependency in your own Helm chart. This allows you to extend its functionality and layer on your own security controls, such as <code>NetworkPolicies</code>, custom <code>RBAC</code> roles, and other security mechanisms that are specific to your environment.</p>
</li>
</ul>
<h2 id="pod-security">Pod Security</h2>
<p>The Pods of the External Secrets Operator have been configured to meet the <a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/">Pod Security Standards</a>, specifically the restricted profile. This configuration ensures a strong security posture by implementing recommended best practices for hardening Pods, including those outlined in the <a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF">NSA Kubernetes Hardening Guide</a>.</p>
<p>By adhering to these standards, the External Secrets Operator benefits from a secure and resilient operating environment. The restricted profile has been set as the default configuration since version <code>v0.8.2</code>, and it is recommended to maintain this setting to align with the principle of least privilege.</p>
<h2 id="role-based-access-control-rbac">Role-Based Access Control (RBAC)</h2>
<p>The External Secrets Operator operates with elevated privileges within your Kubernetes cluster, allowing it to read and write to all secrets across all namespaces. It is crucial to properly restrict access to ESO resources such as <code>ExternalSecret</code> and <code>SecretStore</code> where necessary. This is particularly important for cluster-scoped resources like <code>ClusterExternalSecret</code> and <code>ClusterSecretStore</code>. Unauthorized tampering with these resources by an attacker could lead to unauthorized access to secrets or potential data exfiltration from your system.</p>
<p>In most scenarios, the External Secrets Operator is deployed cluster-wide. However, if you prefer to run it on a per-namespace basis, you can scope it to a specific namespace using the <code>scopedRBAC</code> and <code>scopedNamespace</code> options in the helm chart.</p>
<p>To ensure a secure RBAC configuration, consider the following checklist:</p>
<ul>
<li>Restrict access to execute shell commands (pods/exec) within the External Secrets Operator Pod.</li>
<li>Restrict access to (Cluster)ExternalSecret and (Cluster)SecretStore resources.</li>
<li>Limit access to aggregated ClusterRoles (view/edit/admin) as needed.</li>
<li>If necessary, deploy ESO with scoped RBAC or within a specific namespace.</li>
</ul>
<p>By carefully managing RBAC permissions and scoping the External Secrets Operator appropriately, you can enhance the security of your Kubernetes cluster.</p>
<h3 id="scoping-serviceaccount-token-creation">Scoping ServiceAccount Token Creation</h3>
<p>By default, the ESO controller Role/ClusterRole includes a blanket <code>serviceaccounts/token: create</code> permission. This permission is necessary for authentication methods that rely on <code>serviceAccountRef</code> — such as Vault Kubernetes auth or Conjur JWT auth — where ESO creates a short-lived token for the referenced ServiceAccount and uses it to authenticate with the external secret provider.</p>
<p>However, this means ESO can create tokens for <em>any</em> ServiceAccount within its scope. If the ESO service account is compromised, an attacker could leverage this permission to create tokens for other ServiceAccounts in the cluster (or in the namespace, when using scoped RBAC), effectively impersonating them and escalating privileges beyond ESO's intended scope.</p>
<p>To mitigate this risk, you can set <code>rbac.serviceAccountTokenCreate: false</code> in the Helm chart values. This removes the blanket permission from ESO's Role/ClusterRole entirely.</p>
<p>When this permission is disabled, you must explicitly delegate token creation to ESO on a per-ServiceAccount basis. For each ServiceAccount referenced in a SecretStore's <code>serviceAccountRef</code>, create a Role and RoleBinding that grants ESO token creation scoped to that specific ServiceAccount using the <code>resourceNames</code> constraint:</p>
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">rbac.authorization.k8s.io/v1</span>
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Role</span>
<span class="nt">metadata</span><span class="p">:</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eso-token-&lt;sa-name&gt;</span>
<span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;namespace&gt;</span>
<span class="nt">rules</span><span class="p">:</span>
<span class="w">  </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">apiGroups</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="s">&#39;&#39;</span><span class="p p-Indicator">]</span>
<span class="w">    </span><span class="nt">resources</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="s">&#39;serviceaccounts/token&#39;</span><span class="p p-Indicator">]</span>
<span class="w">    </span><span class="nt">resourceNames</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="s">&#39;&lt;sa-name&gt;&#39;</span><span class="p p-Indicator">]</span>
<span class="w">    </span><span class="nt">verbs</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="s">&#39;create&#39;</span><span class="p p-Indicator">]</span>
<span class="nn">---</span>
<span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">rbac.authorization.k8s.io/v1</span>
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">RoleBinding</span>
<span class="nt">metadata</span><span class="p">:</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eso-token-&lt;sa-name&gt;</span>
<span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;namespace&gt;</span>
<span class="nt">subjects</span><span class="p">:</span>
<span class="w">  </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ServiceAccount</span>
<span class="w">    </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;eso-service-account&gt;</span>
<span class="w">    </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;eso-namespace&gt;</span>
<span class="nt">roleRef</span><span class="p">:</span>
<span class="w">  </span><span class="nt">apiGroup</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">rbac.authorization.k8s.io</span>
<span class="w">  </span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Role</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eso-token-&lt;sa-name&gt;</span>
</code></pre></div>
<p>With this configuration, ESO can only create tokens for ServiceAccounts that have been explicitly granted by the cluster administrator. This follows the principle of least privilege and ensures that a compromised ESO instance cannot be used to impersonate arbitrary ServiceAccounts.</p>
<h2 id="network-traffic-and-security">Network Traffic and Security</h2>
<p>To ensure a secure network environment, it is recommended to restrict network traffic to and from the External Secrets Operator using <code>NetworkPolicies</code> or similar mechanisms. By default, the External Secrets Operator does not include pre-defined Network Policies.</p>
<p>To implement network restrictions effectively, consider the following steps:</p>
<ul>
<li>Define and apply appropriate NetworkPolicies to limit inbound and outbound traffic for the External Secrets Operator.</li>
<li>Specify a "deny all" policy by default and selectively permit necessary communication based on your specific requirements.</li>
<li>Restrict access to only the required endpoints and protocols for the External Secrets Operator, such as communication with the Kubernetes API server or external secret providers.</li>
<li>Regularly review and update the Network Policies to align with changes in your network infrastructure and security requirements.</li>
</ul>
<p>It is the responsibility of the user to define and configure Network Policies tailored to their specific environment and security needs. By implementing proper network restrictions, you can enhance the overall security posture of the External Secrets Operator within your Kubernetes cluster.</p>
<div class="admonition danger">
<p class="admonition-title">Data Exfiltration Risk</p>
<p>If not configured properly ESO may be used to exfiltrate data out of your cluster.
It is advised to create tight NetworkPolicies and use a policy engine such as kyverno to prevent data exfiltration.</p>
</div>
<h3 id="outbound-traffic-restrictions">Outbound Traffic Restrictions</h3>
<h4 id="core-controller">Core Controller</h4>
<p>Restrict outbound traffic from the core controller component to the following destinations:</p>
<ul>
<li><code>kube-apiserver</code>: The Kubernetes API server.</li>
<li>Secret provider (e.g., AWS, GCP): Whenever possible, use private endpoints to establish secure and private communication.</li>
</ul>
<h4 id="webhook">Webhook</h4>
<ul>
<li>Restrict outbound traffic from the webhook component to the <code>kube-apiserver</code>.</li>
</ul>
<h4 id="cert-controller">Cert Controller</h4>
<ul>
<li>Restrict outbound traffic from the cert controller component to the <code>kube-apiserver</code>.</li>
</ul>
<h3 id="inbound-traffic-restrictions">Inbound Traffic Restrictions</h3>
<h4 id="core-controller_1">Core Controller</h4>
<ul>
<li>Restrict inbound traffic to the core controller component by allowing communication on port <code>8080</code> from your monitoring agent.</li>
</ul>
<h4 id="cert-controller_1">Cert Controller</h4>
<ul>
<li>Restrict inbound traffic to the cert controller component by allowing communication on port <code>8080</code> from your monitoring agent.</li>
<li>Additionally, permit inbound traffic on port <code>8081</code> from the kubelet for health check endpoints (healthz/readyz).</li>
</ul>
<h4 id="webhook_1">Webhook</h4>
<p>Restrict inbound traffic to the webhook component as follows:</p>
<ul>
<li>Allow communication on port <code>10250</code> from the kube-apiserver.</li>
<li>Allow communication on port <code>8080</code> from your monitoring agent.</li>
<li>Permit inbound traffic on port <code>8081</code> from the kubelet for health check endpoints (healthz/readyz).</li>
</ul>
<h2 id="policy-engine-best-practices">Policy Engine Best Practices</h2>
<p>To enhance the security and enforce specific policies for External Secrets Operator (ESO) resources such as SecretStore and ExternalSecret, it is recommended to utilize a policy engine like <a href="http://kyverno.io/">Kyverno</a> or <a href="https://github.com/open-policy-agent/gatekeeper">OPA Gatekeeper</a>. These policy engines provide a way to define and enforce custom policies that restrict changes made to ESO resources.</p>
<div class="admonition danger">
<p class="admonition-title">Data Exfiltration Risk</p>
<p>ESO could be used to exfiltrate data out of your cluster. You should disable all providers you don't need.
Further, you should implement <code>NetworkPolicies</code> to restrict network access to known entities (see above), to prevent data exfiltration.</p>
</div>
<p>Here are some recommendations to consider when configuring your policies:</p>
<ol>
<li><strong>Explicitly Deny Unused Providers</strong>: Create policies that explicitly deny the usage of secret providers that are not required in your environment. This prevents unauthorized access to unnecessary providers and reduces the attack surface.</li>
<li><strong>Restrict Access to Secrets</strong>: Implement policies that restrict access to secrets based on specific conditions. For example, you can define policies to allow access to secrets only if they have a particular prefix in the <code>.spec.data[].remoteRef.key</code> field. This helps ensure that only authorized entities can access sensitive information.</li>
<li><strong>Restrict <code>ClusterSecretStore</code> References</strong>: Define policies to restrict the usage of ClusterSecretStore references within ExternalSecret resources. This ensures that the resources are properly scoped and prevent potential unauthorized access to secrets across namespaces.</li>
</ol>
<p>By leveraging a policy engine, you can implement these recommendations and enforce custom policies that align with your organization's security requirements. Please refer to the documentation of the chosen policy engine (e.g., Kyverno or OPA Gatekeeper) for detailed instructions on how to define and enforce policies for ESO resources.</p>
<div class="admonition note">
<p class="admonition-title">Provider Validation Example Policy</p>
<p>The following policy validates the usage of the <code>provider</code> field in the SecretStore manifest.</p>
<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">kyverno.io/v1</span>
<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ClusterPolicy</span>
<span class="nt">metadata</span><span class="p">:</span>
<span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">require-secretstore-aws-provider</span>
<span class="nt">spec</span><span class="p">:</span>
<span class="w">  </span><span class="nt">validationFailureAction</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Enforce</span>
<span class="w">  </span><span class="nt">rules</span><span class="p">:</span>
<span class="w">  </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">require-secretstore-aws-provider</span>
<span class="w">    </span><span class="nt">match</span><span class="p">:</span>
<span class="w">      </span><span class="nt">any</span><span class="p">:</span>
<span class="w">      </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">resources</span><span class="p">:</span>
<span class="w">          </span><span class="nt">kinds</span><span class="p">:</span>
<span class="w">          </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
<span class="w">          </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ClusterSecretStore</span>
<span class="w">    </span><span class="nt">validate</span><span class="p">:</span>
<span class="w">      </span><span class="nt">message</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;You</span><span class="nv"> </span><span class="s">must</span><span class="nv"> </span><span class="s">only</span><span class="nv"> </span><span class="s">use</span><span class="nv"> </span><span class="s">AWS</span><span class="nv"> </span><span class="s">SecretsManager&quot;</span>
<span class="w">      </span><span class="nt">pattern</span><span class="p">:</span>
<span class="w">        </span><span class="nt">spec</span><span class="p">:</span>
<span class="w">          </span><span class="nt">provider</span><span class="p">:</span>
<span class="w">            </span><span class="nt">aws</span><span class="p">:</span>
<span class="w">              </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
</code></pre></div>
</div>
<h2 id="regular-patches">Regular Patches</h2>
<p>To maintain a secure environment, it is crucial to regularly patch and update all software components of External Secrets Operator and the underlying cluster. By doing so, known vulnerabilities can be addressed, and the overall system's security can be improved. Here are some recommended practices for ensuring timely updates:</p>
<ol>
<li><strong>Automated Patching and Updating</strong>: Utilize automated patching and updating tools to streamline the process of keeping software components up-to-date</li>
<li><strong>Regular Update ESO</strong>: Stay informed about the latest updates and releases provided for ESO. The development team regularly releases updates to improve stability, performance, and security. Please refer to the <a href="../../introduction/stability-support/">Stability and Support</a> documentation for more information on the available updates</li>
<li><strong>Cluster-wide Updates</strong>: Apart from ESO, ensure that all other software components within your cluster, such as the operating system, container runtime, and Kubernetes itself, are regularly patched and updated.</li>
</ol>
<p>By adhering to a regular patching and updating schedule, you can proactively mitigate security risks associated with known vulnerabilities and ensure the overall stability and security of your ESO deployment.</p>
<h2 id="verify-artefacts">Verify Artefacts</h2>
<h3 id="verify-container-images">Verify Container Images</h3>
<p>The container images of External Secrets Operator are signed using Cosign and the keyless signing feature. To ensure the authenticity and integrity of the container image, you can follow the steps outlined below:</p>
<div class="highlight"><pre><span></span><code><span class="c1"># Retrieve Image Signature</span>
$<span class="w"> </span>crane<span class="w"> </span>digest<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1
sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554

<span class="c1"># verify signature</span>
$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify<span class="w"> </span>ghcr.io/external-secrets/external-secrets@sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq

<span class="c1"># ...</span>
<span class="o">[</span>
<span class="w">  </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;critical&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;identity&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;docker-reference&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;image&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;docker-manifest-digest&quot;</span>:<span class="w"> </span><span class="s2">&quot;sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;type&quot;</span>:<span class="w"> </span><span class="s2">&quot;cosign container image signature&quot;</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="s2">&quot;optional&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.1&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://token.actions.githubusercontent.com&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.2&quot;</span>:<span class="w"> </span><span class="s2">&quot;workflow_dispatch&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.3&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.4&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.5&quot;</span>:<span class="w"> </span><span class="s2">&quot;external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;1.3.6.1.4.1.57264.1.6&quot;</span>:<span class="w"> </span><span class="s2">&quot;refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Bundle&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="c1"># ...</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;GITHUB_ACTOR&quot;</span>:<span class="w"> </span><span class="s2">&quot;gusfcarvalho&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Issuer&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://token.actions.githubusercontent.com&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Subject&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowName&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowRef&quot;</span>:<span class="w"> </span><span class="s2">&quot;refs/heads/main&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowRepository&quot;</span>:<span class="w"> </span><span class="s2">&quot;external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowSha&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>,
<span class="w">      </span><span class="s2">&quot;githubWorkflowTrigger&quot;</span>:<span class="w"> </span><span class="s2">&quot;workflow_dispatch&quot;</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">}</span>
<span class="o">]</span>
</code></pre></div>
<p>In the output of the verification process, pay close attention to the <code>optional.Issuer</code> and <code>optional.Subject</code> fields. These fields contain important information about the image's authenticity. Verify that the values of Issuer and Subject match the expected values for the ESO container image. If they do not match, it indicates that the image is not legitimate and should not be used.</p>
<p>By following these steps and confirming that the Issuer and Subject fields align with the expected values for the ESO container image, you can ensure that the image has not been tampered with and is safe to use.</p>
<h3 id="verifying-provenance">Verifying Provenance</h3>
<p>The External Secrets Operator employs the <a href="https://slsa.dev/provenance/v0.1">SLSA</a> (Supply Chain Levels for Software Artifacts) standard to create and attest to the provenance of its builds. Provenance verification is essential to ensure the integrity and trustworthiness of the software supply chain. This outlines the process of verifying the attested provenance of External Secrets Operator builds using the cosign tool.</p>
<div class="highlight"><pre><span></span><code>$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify-attestation<span class="w"> </span>--type<span class="w"> </span>slsaprovenance<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span>.payload<span class="w"> </span>-r<span class="w"> </span><span class="p">|</span><span class="w"> </span>base64<span class="w"> </span>--decode<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq

Verification<span class="w"> </span><span class="k">for</span><span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1<span class="w"> </span>--
The<span class="w"> </span>following<span class="w"> </span>checks<span class="w"> </span>were<span class="w"> </span>performed<span class="w"> </span>on<span class="w"> </span>each<span class="w"> </span>of<span class="w"> </span>these<span class="w"> </span>signatures:
<span class="w">  </span>-<span class="w"> </span>The<span class="w"> </span>cosign<span class="w"> </span>claims<span class="w"> </span>were<span class="w"> </span>validated
<span class="w">  </span>-<span class="w"> </span>Existence<span class="w"> </span>of<span class="w"> </span>the<span class="w"> </span>claims<span class="w"> </span><span class="k">in</span><span class="w"> </span>the<span class="w"> </span>transparency<span class="w"> </span>log<span class="w"> </span>was<span class="w"> </span>verified<span class="w"> </span>offline
<span class="w">  </span>-<span class="w"> </span>Any<span class="w"> </span>certificates<span class="w"> </span>were<span class="w"> </span>verified<span class="w"> </span>against<span class="w"> </span>the<span class="w"> </span>Fulcio<span class="w"> </span>roots.
Certificate<span class="w"> </span>subject:<span class="w">  </span>https://github.com/external-secrets/external-secrets/.github/workflows/release.yml@refs/heads/main
Certificate<span class="w"> </span>issuer<span class="w"> </span>URL:<span class="w">  </span>https://token.actions.githubusercontent.com
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Trigger:<span class="w"> </span>workflow_dispatch
GitHub<span class="w"> </span>Workflow<span class="w"> </span>SHA:<span class="w"> </span>a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Name:<span class="w"> </span>Create<span class="w"> </span>Release
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Trigger<span class="w"> </span>external-secrets/external-secrets
GitHub<span class="w"> </span>Workflow<span class="w"> </span>Ref:<span class="w"> </span>refs/heads/main
<span class="o">{</span>
<span class="w">  </span><span class="s2">&quot;_type&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://in-toto.io/Statement/v0.1&quot;</span>,
<span class="w">  </span><span class="s2">&quot;predicateType&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://slsa.dev/provenance/v0.2&quot;</span>,
<span class="w">  </span><span class="s2">&quot;subject&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">    </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets&quot;</span>,
<span class="w">      </span><span class="s2">&quot;digest&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;sha256&quot;</span>:<span class="w"> </span><span class="s2">&quot;36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>
<span class="w">      </span><span class="o">}</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">]</span>,
<span class="w">  </span><span class="s2">&quot;predicate&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;builder&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;id&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/external-secrets/external-secrets/Attestations/GitHubHostedActions@v1&quot;</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="s2">&quot;buildType&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://github.com/Attestations/GitHubActionsWorkflow@v1&quot;</span>,
<span class="w">    </span><span class="s2">&quot;invocation&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;configSource&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;uri&quot;</span>:<span class="w"> </span><span class="s2">&quot;git+https://github.com/external-secrets/external-secrets&quot;</span>,
<span class="w">        </span><span class="s2">&quot;digest&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;sha1&quot;</span>:<span class="w"> </span><span class="s2">&quot;a0d2aef2e35c259c9ee75d65f7587e6ed71ef2ad&quot;</span>
<span class="w">        </span><span class="o">}</span>,
<span class="w">        </span><span class="s2">&quot;entryPoint&quot;</span>:<span class="w"> </span><span class="s2">&quot;Create Release&quot;</span>
<span class="w">      </span><span class="o">}</span>,
<span class="w">      </span><span class="s2">&quot;parameters&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">        </span><span class="s2">&quot;version&quot;</span>:<span class="w"> </span><span class="s2">&quot;v0.8.1&quot;</span>
<span class="w">      </span><span class="o">}</span>
<span class="w">    </span><span class="o">}</span>,
<span class="w">    </span><span class="o">[</span>...<span class="o">]</span>
<span class="w">  </span><span class="o">}</span>
<span class="o">}</span>
</code></pre></div>
<h3 id="fetching-sbom">Fetching SBOM</h3>
<p>Every External Secrets Operator image is accompanied by an SBOM (Software Bill of Materials) in SPDX JSON format. The SBOM provides detailed information about the software components and dependencies used in the image. This technical documentation explains the process of downloading and verifying the SBOM for a specific version of External Secrets Operator using the Cosign tool.</p>
<div class="highlight"><pre><span></span><code>$<span class="w"> </span>crane<span class="w"> </span>digest<span class="w"> </span>ghcr.io/external-secrets/external-secrets:v0.8.1
sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554

$<span class="w"> </span><span class="nv">COSIGN_EXPERIMENTAL</span><span class="o">=</span><span class="m">1</span><span class="w"> </span>cosign<span class="w"> </span>verify-attestation<span class="w"> </span>--type<span class="w"> </span>spdx<span class="w"> </span>ghcr.io/external-secrets/external-secrets@sha256:36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554<span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span><span class="s1">&#39;.payload |= @base64d | .payload | fromjson&#39;</span><span class="w"> </span><span class="p">|</span><span class="w"> </span>jq<span class="w"> </span><span class="s1">&#39;.predicate.Data | fromjson&#39;</span>

<span class="o">[</span>...<span class="o">]</span>
<span class="o">{</span>
<span class="w">  </span><span class="s2">&quot;SPDXID&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDXRef-DOCUMENT&quot;</span>,
<span class="w">  </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;ghcr.io/external-secrets/external-secrets@sha256-36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554&quot;</span>,
<span class="w">  </span><span class="s2">&quot;spdxVersion&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDX-2.2&quot;</span>,
<span class="w">  </span><span class="s2">&quot;creationInfo&quot;</span>:<span class="w"> </span><span class="o">{</span>
<span class="w">    </span><span class="s2">&quot;created&quot;</span>:<span class="w"> </span><span class="s2">&quot;2023-03-17T23:17:01.568002344Z&quot;</span>,
<span class="w">    </span><span class="s2">&quot;creators&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">      </span><span class="s2">&quot;Organization: Anchore, Inc&quot;</span>,
<span class="w">      </span><span class="s2">&quot;Tool: syft-0.40.1&quot;</span>
<span class="w">    </span><span class="o">]</span>,
<span class="w">    </span><span class="s2">&quot;licenseListVersion&quot;</span>:<span class="w"> </span><span class="s2">&quot;3.16&quot;</span>
<span class="w">  </span><span class="o">}</span>,
<span class="w">  </span><span class="s2">&quot;dataLicense&quot;</span>:<span class="w"> </span><span class="s2">&quot;CC0-1.0&quot;</span>,
<span class="w">  </span><span class="s2">&quot;documentNamespace&quot;</span>:<span class="w"> </span><span class="s2">&quot;https://anchore.com/syft/image/ghcr.io/external-secrets/external-secrets@sha256-36e606279dbebac51b4b9300b9fa85e8c08c1c673ba3ecc38af1402a0b035554-83484ebb-b469-45fa-8fcc-9290c4ea4f6f&quot;</span>,
<span class="w">  </span><span class="s2">&quot;packages&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">    </span><span class="o">[</span>...<span class="o">]</span>
<span class="w">    </span><span class="o">{</span>
<span class="w">      </span><span class="s2">&quot;SPDXID&quot;</span>:<span class="w"> </span><span class="s2">&quot;SPDXRef-c809070b0beb099e&quot;</span>,
<span class="w">      </span><span class="s2">&quot;name&quot;</span>:<span class="w"> </span><span class="s2">&quot;tzdata&quot;</span>,
<span class="w">      </span><span class="s2">&quot;licenseConcluded&quot;</span>:<span class="w"> </span><span class="s2">&quot;NONE&quot;</span>,
<span class="w">      </span><span class="s2">&quot;downloadLocation&quot;</span>:<span class="w"> </span><span class="s2">&quot;NOASSERTION&quot;</span>,
<span class="w">      </span><span class="s2">&quot;externalRefs&quot;</span>:<span class="w"> </span><span class="o">[</span>
<span class="w">        </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;referenceCategory&quot;</span>:<span class="w"> </span><span class="s2">&quot;SECURITY&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceLocator&quot;</span>:<span class="w"> </span><span class="s2">&quot;cpe:2.3:a:tzdata:tzdata:2021a-1\\+deb11u8:*:*:*:*:*:*:*&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceType&quot;</span>:<span class="w"> </span><span class="s2">&quot;cpe23Type&quot;</span>
<span class="w">        </span><span class="o">}</span>,
<span class="w">        </span><span class="o">{</span>
<span class="w">          </span><span class="s2">&quot;referenceCategory&quot;</span>:<span class="w"> </span><span class="s2">&quot;PACKAGE_MANAGER&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceLocator&quot;</span>:<span class="w"> </span><span class="s2">&quot;pkg:deb/debian/tzdata@2021a-1+deb11u8?arch=all&amp;distro=debian-11&quot;</span>,
<span class="w">          </span><span class="s2">&quot;referenceType&quot;</span>:<span class="w"> </span><span class="s2">&quot;purl&quot;</span>
<span class="w">        </span><span class="o">}</span>
<span class="w">      </span><span class="o">]</span>,
<span class="w">      </span><span class="s2">&quot;filesAnalyzed&quot;</span>:<span class="w"> </span>false,
<span class="w">      </span><span class="s2">&quot;licenseDeclared&quot;</span>:<span class="w"> </span><span class="s2">&quot;NONE&quot;</span>,
<span class="w">      </span><span class="s2">&quot;originator&quot;</span>:<span class="w"> </span><span class="s2">&quot;Person: GNU Libc Maintainers &lt;debian-glibc@lists.debian.org&gt;&quot;</span>,
<span class="w">      </span><span class="s2">&quot;sourceInfo&quot;</span>:<span class="w"> </span><span class="s2">&quot;acquired package info from DPKG DB: /var/lib/dpkg/status.d/tzdata, /usr/share/doc/tzdata/copyright&quot;</span>,
<span class="w">      </span><span class="s2">&quot;versionInfo&quot;</span>:<span class="w"> </span><span class="s2">&quot;2021a-1+deb11u8&quot;</span>
<span class="w">    </span><span class="o">}</span>
<span class="w">  </span><span class="o">]</span>
<span class="o">}</span>
</code></pre></div>


              </article>
            </div>
          
          
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
        </div>
        
      </main>
      
<img referrerpolicy="no-referrer-when-downgrade"
  src="https://static.scarf.sh/a.png?x-pxid=6658a9eb-067d-49f1-94f2-b8b00f21451e" alt=""
  hidden />
  
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      &copy; 2025 The external-secrets Authors.<br/>
&copy; 2025 The Linux Foundation. All rights reserved.<br/><br/>
The Linux Foundation has registered trademarks and uses trademarks.<br/>
For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage/">Trademark Usage page</a>.

    </div>
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      

    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    
      <script id="__config" type="application/json">{"annotate": null, "base": "../..", "features": ["navigation.tabs", "navigation.indexes", "navigation.expand"], "search": "../../assets/javascripts/workers/search.2c215733.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"provider": "mike"}}</script>
    
    
      <script src="../../assets/javascripts/bundle.d7400e89.min.js"></script>
      
    
  </body>
</html>