helm-external-secrets/docs/provider/passbolt.md

External Secrets Operator integrates with Passbolt API to sync Passbolt to secrets held on the Kubernetes cluster.

Creating a Passbolt secret store

Be sure the passbolt provider is listed in the Kind=SecretStore and auth and host are set. The API requires a password and private key provided in a secret.

{% include 'passbolt-secret-store.yaml' %}

Custom CA certificate

If your Passbolt instance uses a certificate signed by a private or custom Certificate Authority, you can configure the CA bundle that ESO uses to validate the Passbolt server certificate. Either supply the PEM-encoded bundle inline via caBundle, or reference a Secret/ConfigMap via caProvider.

{% include 'passbolt-secret-store-ca.yaml' %}

If neither caBundle nor caProvider is set, ESO uses the system root certificates to validate the TLS connection.

Creating an external secret

To sync a Passbolt secret to a Kubernetes secret, a Kind=ExternalSecret is needed. By default the secret contains name, username, uri, password and description.

To only select a single property add the property key.

{% include 'passbolt-external-secret-example.yaml' %}

The above external secret will lead to the creation of a secret in the following form:

{% include 'passbolt-secret-example.yaml' %}

Finding a secret by name

Instead of retrieving secrets by ID you can also use dataFrom to search for secrets by name.

{% include 'passbolt-external-secret-findbyname.yaml' %}

Custom fields

Passbolt resources can carry arbitrary custom fields beyond the standard name, username, password, uri, and description properties. ESO surfaces each custom field through the custom_fields.<name> property syntax, where <name> is the field's display name as configured in Passbolt.

{% include 'passbolt-external-secret-custom-fields.yaml' %}

The above external secret produces a Kubernetes Secret in the following form:

{% include 'passbolt-secret-custom-fields-example.yaml' %}

When no property is specified, the full secret is returned as a JSON object. The custom_fields key is included in that object whenever the resource has at least one named custom field.

Passbolt stores each half of a custom field on whichever side the field's configuration calls for: a name is either cleartext metadata or encrypted alongside the secret, and so is a value. ESO decrypts both sides before reading them, so a field is addressable by its display name either way.