The AccessKeyID is used for authentication

The SecretAccessKey is used for authentication

Service defines which service should be used to fetch the secrets

Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials

Role is a Role ARN which the SecretManager provider will assume

AWS Region to be used for the provider

"ParameterStore"

AWSServiceParameterStore is the AWS SystemsManager ParameterStore. see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

"SecretsManager"

AWSServiceSecretsManager is the AWS SecretsManager. see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

"Ready"

"Merge"

Merge does not create the Secret, but merges the data fields to the Secret.

"None"

None does not create a Secret (future use with injector).

"Owner"

Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.

Key is the key used in the Provider, mandatory

Used to select a specific version of the Provider value, if supported

Used to select a specific property of the Provider value (if a map), if supported

RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.

Data defines the connection between the Kubernetes Secret keys and the Provider data

DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

refreshTime is the time and date the external secret was fetched and the target secret updated

Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource

CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’

Template defines a blueprint for the created Secret resource.

"Ready"

AWS configures this store to sync secrets using AWS Secret Manager provider

Vault configures this store to sync secrets using Hashi provider

Name of the SecretStore resource

Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to SecretStore

Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property

Used to configure the provider. Only one provider may be set

Path where the App Role authentication backend is mounted in Vault, e.g: “approle”

RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault.

Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role secret.

TokenSecretRef authenticates with Vault by presenting a token.

AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.

Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.

Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method

Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method

Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method

SecretRef to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method

"v1"

"v2"

Path where the Kubernetes authentication backend is mounted in Vault, e.g: “kubernetes”

Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead.

Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used.

A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.

Username is a LDAP user name used to authenticate using the LDAP Vault authentication method

SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method

Auth configures how secret-manager authenticates with the Vault server.

Server is the connection address for the Vault server, e.g: “https://vault.example.com:8200”.

Path is the mount path of the Vault KV backend endpoint, e.g: “secret”. The v2 KV secret engine version specific “/data” path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path.

Version is the Vault KV secret engine version. This can be either “v1” or “v2”. Version defaults to “v2”.

Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: “ns1”. More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces

PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection.