external-secrets/docs/spec.md

Packages:

• external-secrets.io/v1alpha1

external-secrets.io/v1alpha1

Package v1alpha1 contains resources for external-secrets

Resource Types:

AWSAuth

(Appears on: AWSProvider)

AWSAuth contains a secretRef for credentials.

Field	Description
secretRef AWSAuthSecretRef

AWSAuthSecretRef

(Appears on: AWSAuth)

AWSAuthSecretRef holds secret references for aws credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.

Field	Description
accessKeyIDSecretRef github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector	The AccessKeyID is used for authentication
secretAccessKeySecretRef github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector	The SecretAccessKey is used for authentication

AWSProvider

(Appears on: SecretStoreProvider)

AWSProvider configures a store to sync secrets using the AWS Secret Manager provider.

Field	Description
service AWSServiceType	Service defines which service should be used to fetch the secrets
auth AWSAuth	(Optional) Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
role string	(Optional) Role is a Role ARN which the SecretManager provider will assume
region string	AWS Region to be used for the provider

AWSServiceType (string alias)

(Appears on: AWSProvider)

AWSServiceType is a enum that defines the service/API that is used to fetch the secrets

Value	Description
"ParameterStore"	AWSServiceParameterStore is the AWS SystemsManager ParameterStore see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
"SecretsManager"	AWSServiceSecretsManager is the AWS SecretsManager see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

ClusterSecretStore

ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Field	Description
metadata Kubernetes meta/v1.ObjectMeta	Refer to the Kubernetes API documentation for the fields of the metadata field.
spec SecretStoreSpec	controller string (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property provider SecretStoreProvider Used to configure the provider. Only one provider may be set

ExternalSecret

ExternalSecret is the Schema for the external-secrets API.

Field	Description
metadata Kubernetes meta/v1.ObjectMeta	Refer to the Kubernetes API documentation for the fields of the metadata field.
spec ExternalSecretSpec	secretStoreRef SecretStoreRef target ExternalSecretTarget refreshInterval Kubernetes meta/v1.Duration RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h. data []ExternalSecretData (Optional) Data defines the connection between the Kubernetes Secret keys and the Provider data dataFrom []ExternalSecretDataRemoteRef (Optional) DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order
status ExternalSecretStatus

ExternalSecretConditionType (string alias)

(Appears on: ExternalSecretStatusCondition)

Value	Description
"Ready"

ExternalSecretCreationPolicy (string alias)

(Appears on: ExternalSecretTarget)

ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.

Value	Description
"Merge"	Merge does not create the Secret, but merges the data fields to the Secret.
"None"	None does not create a Secret (future use with injector).
"Owner"	Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.

ExternalSecretData

(Appears on: ExternalSecretSpec)

ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.

Field	Description
secretKey string
remoteRef ExternalSecretDataRemoteRef

ExternalSecretDataRemoteRef

(Appears on: ExternalSecretData, ExternalSecretSpec)

ExternalSecretDataRemoteRef defines Provider data location.

Field	Description
key string	Key is the key used in the Provider, mandatory
version string	(Optional) Used to select a specific version of the Provider value, if supported
property string	(Optional) Used to select a specific property of the Provider value (if a map), if supported

ExternalSecretSpec

(Appears on: ExternalSecret)

ExternalSecretSpec defines the desired state of ExternalSecret.

Field	Description
secretStoreRef SecretStoreRef
target ExternalSecretTarget
refreshInterval Kubernetes meta/v1.Duration	RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.
data []ExternalSecretData	(Optional) Data defines the connection between the Kubernetes Secret keys and the Provider data
dataFrom []ExternalSecretDataRemoteRef	(Optional) DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

ExternalSecretStatus

(Appears on: ExternalSecret)

Field	Description
refreshTime Kubernetes meta/v1.Time	refreshTime is the time and date the external secret was fetched and the target secret updated
conditions []ExternalSecretStatusCondition	(Optional)

ExternalSecretStatusCondition

(Appears on: ExternalSecretStatus)

Field	Description
type ExternalSecretConditionType
status Kubernetes core/v1.ConditionStatus
reason string	(Optional)
message string	(Optional)
lastTransitionTime Kubernetes meta/v1.Time	(Optional)

ExternalSecretTarget

(Appears on: ExternalSecretSpec)

ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.

Field	Description
name string	(Optional) Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
creationPolicy ExternalSecretCreationPolicy	(Optional) CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’

ExternalSecretTemplate

ExternalSecretTemplate defines a blueprint for the created Secret resource.

Field	Description
type Kubernetes core/v1.SecretType	(Optional)
metadata ExternalSecretTemplateMetadata	(Optional)

ExternalSecretTemplateMetadata

(Appears on: ExternalSecretTemplate)

ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.

Field	Description
annotations map[string]string	(Optional)
labels map[string]string	(Optional)

GenericStore

GenericStore is a common interface for interacting with ClusterSecretStore or a namespaced SecretStore.

ProviderIdentity

ProviderIdentity returns the name of a secret store provider this interface must be implemented by every provider

SecretStore

SecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

Field	Description
metadata Kubernetes meta/v1.ObjectMeta	Refer to the Kubernetes API documentation for the fields of the metadata field.
spec SecretStoreSpec	controller string (Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property provider SecretStoreProvider Used to configure the provider. Only one provider may be set
status SecretStoreStatus

SecretStoreConditionType (string alias)

(Appears on: SecretStoreStatusCondition)

Value	Description
"Ready"

SecretStoreProvider

(Appears on: SecretStoreSpec)

SecretStoreProvider contains the provider-specific configration.

Field	Description
aws AWSProvider	(Optional) AWS configures this store to sync secrets using AWS Secret Manager provider

SecretStoreRef

(Appears on: ExternalSecretSpec)

SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.

Field	Description
name string	Name of the SecretStore resource
kind string	(Optional) Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to SecretStore

SecretStoreSpec

(Appears on: ClusterSecretStore, SecretStore)

SecretStoreSpec defines the desired state of SecretStore.

Field	Description
controller string	(Optional) Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
provider SecretStoreProvider	Used to configure the provider. Only one provider may be set

SecretStoreStatus

(Appears on: SecretStore)

SecretStoreStatus defines the observed state of the SecretStore.

Field	Description
conditions []SecretStoreStatusCondition	(Optional)

SecretStoreStatusCondition

(Appears on: SecretStoreStatus)

Field	Description
type SecretStoreConditionType
status Kubernetes core/v1.ConditionStatus
reason string	(Optional)
message string	(Optional)
lastTransitionTime Kubernetes meta/v1.Time	(Optional)

---

Generated with gen-crd-api-reference-docs.