ExternalSecret
external-secrets.io / v1alpha1
apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
ExternalSecretSpec defines the desired state of ExternalSecret.
data []object
Data defines the connection between the Kubernetes Secret keys and the Provider data
remoteRef object required
ExternalSecretDataRemoteRef defines Provider data location.
conversionStrategy
string
Used to define a conversion Strategy
enum:
Default, Unicode
key
string required
Key is the key used in the Provider, mandatory
property
string
Used to select a specific property of the Provider value (if a map), if supported
version
string
Used to select a specific version of the Provider value, if supported
secretKey
string required
The key in the Kubernetes Secret to store the value.
pattern:
^[-._a-zA-Z0-9]+$minLength:
1maxLength:
253dataFrom []object
DataFrom is used to fetch all properties from a specific Provider data
If multiple entries are specified, the Secret keys are merged in the specified order
conversionStrategy
string
Used to define a conversion Strategy
enum:
Default, Unicode
key
string required
Key is the key used in the Provider, mandatory
property
string
Used to select a specific property of the Provider value (if a map), if supported
version
string
Used to select a specific version of the Provider value, if supported
refreshInterval
string
RefreshInterval is the amount of time before the values are read again from the SecretStore provider
Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
May be set to zero to fetch and create it once. Defaults to 1h.
secretStoreRef object required
SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
kind
string
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to `SecretStore`
enum:
SecretStore, ClusterSecretStore
name
string
Name of the SecretStore resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253target object required
ExternalSecretTarget defines the Kubernetes Secret to be created
There can be only one target per ExternalSecret.
creationPolicy
string
CreationPolicy defines rules on how to create the resulting Secret.
Defaults to "Owner"
enum:
Owner, Merge, None
immutable
boolean
Immutable defines if the final secret will be immutable
name
string
The name of the Secret resource to be managed.
Defaults to the .metadata.name of the ExternalSecret resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253template object
Template defines a blueprint for the created Secret resource.
data
object
engineVersion
string
EngineVersion specifies the template engine version
that should be used to compile/execute the
template specified in .data and .templateFrom[].
enum:
v1, v2metadata object
ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
annotations
object
labels
object
templateFrom []object
configMap object
items []object required
A list of keys in the ConfigMap/Secret to use as templates for Secret data
key
string required
A key in the ConfigMap/Secret
pattern:
^[-._a-zA-Z0-9]+$minLength:
1maxLength:
253
name
string required
The name of the ConfigMap/Secret resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253secret object
items []object required
A list of keys in the ConfigMap/Secret to use as templates for Secret data
key
string required
A key in the ConfigMap/Secret
pattern:
^[-._a-zA-Z0-9]+$minLength:
1maxLength:
253
name
string required
The name of the ConfigMap/Secret resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253
type
string
status object
binding object
Binding represents a servicebinding.io Provisioned Service reference to the secret
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
conditions []object
lastTransitionTime
string
format:
date-time
message
string
reason
string
status
string required
type
string required
refreshTime
string
refreshTime is the time and date the external secret was fetched and
the target secret updated
format:
date-time
syncedResourceVersion
string
SyncedResourceVersion keeps track of the last synced version
No matches. Try .spec.data for an exact path