PushSecret
external-secrets.io / v1alpha1
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
PushSecretSpec configures the behavior of the PushSecret.
data []object
Secret Data that should be pushed to providers
conversionStrategy
string
Used to define a conversion Strategy for the secret keys
enum:
None, ReverseUnicodematch object required
Match a given Secret Key to be pushed to the provider.
remoteRef object required
Remote Refs to push to providers.
property
string
Name of the property in the resulting secret
remoteKey
string required
Name of the resulting provider secret.
secretKey
string
Secret Key to be pushed
metadata
object
Metadata is metadata attached to the secret.
The structure of metadata is provider specific, please look it up in the provider documentation.
deletionPolicy
string
Deletion Policy to handle Secrets in the provider.
enum:
Delete, None
refreshInterval
string
The Interval to which External Secrets will try to push a secret definition
secretStoreRefs []object required
kind
string
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
enum:
SecretStore, ClusterSecretStorelabelSelector object
Optionally, sync to secret stores with label selector
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
name
string
Optionally, sync to the SecretStore of the given name
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253selector object required
The Secret Selector (k8s source) for the Push Secret
generatorRef object
Point to a generator to create a Secret.
apiVersion
string
Specify the apiVersion of the generator resource
kind
string required
Specify the Kind of the generator resource
enum:
enum: ACRAccessToken, ClusterGenerator, ECRAuthorizationToken, Fake, GCRAccessToken, GithubAccessToken, QuayAccessToken, Passw...
ACRAccessToken, ClusterGenerator, ECRAuthorizationToken, Fake, GCRAccessToken, GithubAccessToken, QuayAccessToken, Password, STSSessionToken, UUID, VaultDynamicSecret, Webhook, Grafana
name
string required
Specify the name of the generator resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253secret object
Select a Secret to Push.
name
string required
Name of the Secret.
The Secret must exist in the same namespace as the PushSecret manifest.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253template object
Template defines a blueprint for the created Secret resource.
data
object
engineVersion
string
EngineVersion specifies the template engine version
that should be used to compile/execute the
template specified in .data and .templateFrom[].
enum:
v1, v2
mergePolicy
string
enum:
Replace, Mergemetadata object
ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
annotations
object
labels
object
templateFrom []object
configMap object
items []object required
A list of keys in the ConfigMap/Secret to use as templates for Secret data
key
string required
A key in the ConfigMap/Secret
pattern:
^[-._a-zA-Z0-9]+$minLength:
1maxLength:
253
templateAs
string
enum:
Values, KeysAndValues
name
string required
The name of the ConfigMap/Secret resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253
literal
string
secret object
items []object required
A list of keys in the ConfigMap/Secret to use as templates for Secret data
key
string required
A key in the ConfigMap/Secret
pattern:
^[-._a-zA-Z0-9]+$minLength:
1maxLength:
253
templateAs
string
enum:
Values, KeysAndValues
name
string required
The name of the ConfigMap/Secret resource
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253
target
string
enum:
Data, Annotations, Labels
type
string
updatePolicy
string
UpdatePolicy to handle Secrets in the provider.
enum:
Replace, IfNotExistsstatus object
PushSecretStatus indicates the history of the status of PushSecret.
conditions []object
lastTransitionTime
string
format:
date-time
message
string
reason
string
status
string required
type
string required
PushSecretConditionType indicates the condition of the PushSecret.
refreshTime
string
refreshTime is the time and date the external secret was fetched and
the target secret updated
format:
date-time
syncedPushSecrets
object
Synced PushSecrets, including secrets that already exist in provider.
Matches secret stores to PushSecretData that was stored to that secret store.
syncedResourceVersion
string
SyncedResourceVersion keeps track of the last synced version.
No matches. Try .spec.data for an exact path