mirrors/external-secrets
1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-15 17:51:01 +00:00
Code Activity
external-secrets/docs/api/controller-options.md

64 lines
14 KiB
Markdown
Raw Normal View History

Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
---
hide:
- toc
---
# Controller Options
The external-secrets binary includes three components: `core controller`, `certcontroller` and `webook`.
## Core Controller Flags
The core controller is invoked without a subcommand and can be configured with the following flags:
:book: fix typo (#2042) Signed-off-by: bvdboom <bvdboom@users.noreply.github.com> Co-authored-by: Bernard <bv.local>
2023-02-23 13:08:39 +00:00
| Name | Type | Default | Description |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| --------------------------------------------- | -------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--client-burst` | int | uses rest client default (10) | Maximum Burst allowed to be passed to rest.Client |
| `--client-qps` | float32 | uses rest client default (5) | QPS configuration to be passed to rest.Client |
| `--concurrent` | int | 1 | The number of concurrent ExternalSecret reconciles. |
| `--controller-class` | string | default | The controller is instantiated with a specific controller name and filters ES based on this property |
| `--enable-cluster-external-secret-reconciler` | boolean | true | Enables the cluster external secret reconciler. |
| `--enable-cluster-store-reconciler` | boolean | true | Enables the cluster store reconciler. |
| `--enable-secrets-caching` | boolean | false | Enables the secrets caching for external-secrets pod. |
| `--enable-configmaps-caching` | boolean | false | Enables the ConfigMap caching for external-secrets pod. |
| `--enable-flood-gate` | boolean | true | Enable flood gate. External secret will be reconciled only if the ClusterStore or Store have an healthy or unknown state. |
Added support for standard K8s labels in metrics (#2064) * Added support for standard K8s labels in metrics Signed-off-by: KA <110458464+kallymsft@users.noreply.github.com> * Added feature-flag for label metrics Signed-off-by: KA <110458464+kallymsft@users.noreply.github.com> --------- Signed-off-by: KA <110458464+kallymsft@users.noreply.github.com>
2023-04-05 17:58:17 +00:00
| `--enable-extended-metric-labels` | boolean | true | Enable recommended kubernetes annotations as labels in metrics. |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| `--enable-leader-election` | boolean | false | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
| `--experimental-enable-aws-session-cache` | boolean | false | Enable experimental AWS session cache. External secret will reuse the AWS session without creating a new one on each request. |
| `--help` | | | help for external-secrets |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--namespace` | string | - | watch external secrets scoped in the provided namespace only. ClusterSecretStore can be used but only work if it doesn't reference resources from other namespaces |
| `--store-requeue-interval` | duration | 5m0s | Default Time duration between reconciling (Cluster)SecretStores |
## Cert Controller Flags
| Name | Type | Default | Descripton |
| -------------------------- | -------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------- |
| `--crd-requeue-interval` | duration | 5m0s | Time duration between reconciling CRDs for new certs |
| `--enable-leader-election` | boolean | false | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
| `--healthz-addr` | string | :8081 | The address the health endpoint binds to. |
| `--help` | | | help for certcontroller |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--secret-name` | string | external-secrets-webhook | Secret to store certs for webhook |
| `--secret-namespace` | string | default | namespace of the secret to store certs |
| `--service-name` | string | external-secrets-webhook | Webhook service name |
| `--service-namespace` | string | default | Webhook service namespace |
## Webhook Flags
:book: fix typo (#2042) Signed-off-by: bvdboom <bvdboom@users.noreply.github.com> Co-authored-by: Bernard <bv.local>
2023-02-23 13:08:39 +00:00
| Name | Type | Default | Description |
Feature: initial generator implementation + Github Actions OIDC/AWS (#1539) Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Co-authored-by: Gustavo Fernandes de Carvalho <gusfcarvalho@gmail.com>
2022-10-29 18:15:50 +00:00
| ---------------------- | -------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--cert-dir` | string | /tmp/k8s-webhook-server/serving-certs | path to check for certs |
| `--check-interval` | duration | 5m0s | certificate check interval |
| `--dns-name` | string | localhost | DNS name to validate certificates with |
| `--healthz-addr` | string | :8081 | The address the health endpoint binds to. |
| `--help` | | | help for webhook |
| `--loglevel` | string | info | loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal |
| `--lookahead-interval` | duration | 2160h0m0s (90d) | certificate check interval |
| `--metrics-addr` | string | :8080 | The address the metric endpoint binds to. |
| `--port` | number | 10250 | Port number that the webhook server will serve. |
| `--tls-ciphers` | string | | comma separated list of tls ciphers allowed. This does not apply to TLS 1.3 as the ciphers are selected automatically. The order of this list does not give preference to the ciphers, the ordering is done automatically. Full lists of available ciphers can be found at https://pkg.go.dev/crypto/tls#pkg-constants. E.g. 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256' |
| `--tls-min-version` | string | 1.2 | minimum version of TLS supported. |
Copy permalink