mirrors/external-secrets
1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
Code Activity
external-secrets/docs/api/controller-options.md

68 lines
15 KiB
Markdown
Raw Normal View History

Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
---
hide:
- toc
---
# Controller Options
The external-secrets binary includes three components: `core controller`, `certcontroller` and `webook`.
## Core Controller Flags
The core controller is invoked without a subcommand and can be configured with the following flags:
feat: add e2e tests for aws role-based auth (#2376) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-12 10:58:29 +00:00
| Name | Type | Default | Description |
Revert "3012 - Probes for external-secrets (#3131)" (#3213) This reverts commit 7eebfa027cfe17b3939e93ac044fd21885d362c3. Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
2024-03-01 12:22:35 +00:00
| --------------------------------------------- | -------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--client-burst` | int | uses rest client default (10) | Maximum Burst allowed to be passed to rest.Client |
| `--client-qps` | float32 | uses rest client default (5) | QPS configuration to be passed to rest.Client |
feat: add e2e tests for aws role-based auth (#2376) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-12 10:58:29 +00:00
| `--concurrent` | int | 1 | The number of concurrent reconciles. |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--controller-class` | string | default | The controller is instantiated with a specific controller name and filters ES based on this property |
| `--enable-cluster-external-secret-reconciler` | boolean | true | Enables the cluster external secret reconciler. |
| `--enable-cluster-store-reconciler` | boolean | true | Enables the cluster store reconciler. |
docs: add push secret reconciler to core controller flags (#2355) Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>
2023-05-25 11:13:12 +00:00
| `--enable-push-secret-reconciler` | boolean | true | Enables the push secret reconciler. |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--enable-secrets-caching` | boolean | false | Enables the secrets caching for external-secrets pod. |
| `--enable-configmaps-caching` | boolean | false | Enables the ConfigMap caching for external-secrets pod. |
| `--enable-flood-gate` | boolean | true | Enable flood gate. External secret will be reconciled only if the ClusterStore or Store have an healthy or unknown state. |
feat: add e2e tests for aws role-based auth (#2376) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-12 10:58:29 +00:00
| `--enable-extended-metric-labels` | boolean | true | Enable recommended kubernetes annotations as labels in metrics. |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--enable-leader-election` | boolean | false | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
| `--experimental-enable-aws-session-cache` | boolean | false | Enable experimental AWS session cache. External secret will reuse the AWS session without creating a new one on each request. |
| `--help` | | | help for external-secrets |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
add log.level and log.encoding to all components (#3558) * add log.level and log.encoding to all components Signed-off-by: Aviv Guiser <avivguiser@gmail.com> Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2024-06-08 13:37:01 +00:00
| `--zap-time-encoding` | string | epoch | loglevel to use, one of: epoch, millis, nano, iso8601, rfc3339, rfc3339nano |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--namespace` | string | - | watch external secrets scoped in the provided namespace only. ClusterSecretStore can be used but only work if it doesn't reference resources from other namespaces |
| `--store-requeue-interval` | duration | 5m0s | Default Time duration between reconciling (Cluster)SecretStores |
## Cert Controller Flags
| Name | Type | Default | Descripton |
Revert "3012 - Probes for external-secrets (#3131)" (#3213) This reverts commit 7eebfa027cfe17b3939e93ac044fd21885d362c3. Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
2024-03-01 12:22:35 +00:00
| -------------------------- | -------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------- |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--crd-requeue-interval` | duration | 5m0s | Time duration between reconciling CRDs for new certs |
| `--enable-leader-election` | boolean | false | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
| `--healthz-addr` | string | :8081 | The address the health endpoint binds to. |
| `--help` | | | help for certcontroller |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
add log.level and log.encoding to all components (#3558) * add log.level and log.encoding to all components Signed-off-by: Aviv Guiser <avivguiser@gmail.com> Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2024-06-08 13:37:01 +00:00
| `--zap-time-encoding` | string | epoch | time encoding to use, one of: epoch, millis, nano, iso8601, rfc3339, rfc3339nano |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--secret-name` | string | external-secrets-webhook | Secret to store certs for webhook |
| `--secret-namespace` | string | default | namespace of the secret to store certs |
| `--service-name` | string | external-secrets-webhook | Webhook service name |
| `--service-namespace` | string | default | Webhook service namespace |
## Webhook Flags
feat: add e2e tests for aws role-based auth (#2376) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>
2023-06-12 10:58:29 +00:00
| Name | Type | Default | Description |
Revert "3012 - Probes for external-secrets (#3131)" (#3213) This reverts commit 7eebfa027cfe17b3939e93ac044fd21885d362c3. Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
2024-03-01 12:22:35 +00:00
| ---------------------- | -------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--cert-dir` | string | /tmp/k8s-webhook-server/serving-certs | path to check for certs |
| `--check-interval` | duration | 5m0s | certificate check interval |
| `--dns-name` | string | localhost | DNS name to validate certificates with |
| `--healthz-addr` | string | :8081 | The address the health endpoint binds to. |
| `--help` | | | help for webhook |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
add log.level and log.encoding to all components (#3558) * add log.level and log.encoding to all components Signed-off-by: Aviv Guiser <avivguiser@gmail.com> Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Moritz Johner <beller.moritz@googlemail.com>
2024-06-08 13:37:01 +00:00
| `--zap-time-encoding` | string | epoch | time encoding to use, one of: epoch, millis, nano, iso8601, rfc3339, rfc3339nano |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--lookahead-interval` | duration | 2160h0m0s (90d) | certificate check interval |
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--port` | number | 10250 | Port number that the webhook server will serve. |
| `--tls-ciphers` | string | | comma separated list of tls ciphers allowed. This does not apply to TLS 1.3 as the ciphers are selected automatically. The order of this list does not give preference to the ciphers, the ordering is done automatically. Full lists of available ciphers can be found at https://pkg.go.dev/crypto/tls#pkg-constants. E.g. 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256' |
| `--tls-min-version` | string | 1.2 | minimum version of TLS supported. |
Copy permalink