external-secrets
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
global:
2
nodeSelector: {}
3
tolerations: []
4
topologySpreadConstraints: []
5
# - maxSkew: 1
6
# topologyKey: topology.kubernetes.io/zone
7
# whenUnsatisfiable: ScheduleAnyway
8
# matchLabelKeys:
9
# - pod-template-hash
10
# - maxSkew: 1
11
# topologyKey: kubernetes.io/hostname
12
# whenUnsatisfiable: DoNotSchedule
13
# matchLabelKeys:
14
# - pod-template-hash
15
affinity: {}
16
# -- Global hostAliases to be applied to all deployments
17
hostAliases: []
18
# -- Global pod labels to be applied to all deployments
19
podLabels: {}
20
# -- Global pod annotations to be applied to all deployments
21
podAnnotations: {}
22
# -- Global imagePullSecrets to be applied to all deployments
23
imagePullSecrets: []
24
# -- Global image repository to be applied to all deployments
25
repository: ""
26
compatibility:
27
openshift:
28
# -- Manages the securityContext properties to make them compatible with OpenShift.
29
# Possible values:
30
# auto - Apply configurations if it is detected that OpenShift is the target platform.
31
# force - Always apply configurations.
32
# disabled - No modification applied.
33
adaptSecurityContext: auto
34
replicaCount: 1
35
bitwarden-sdk-server:
36
enabled: false
37
namespaceOverride: ""
38
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
39
revisionHistoryLimit: 10
40
image:
41
repository: cgr.dev/chainguard-private/external-secrets-fips
42
pullPolicy: IfNotPresent
43
# -- The image tag to use. The default is the chart appVersion.
44
tag: 2.9.0@sha256:316ca23eec3d8eb5af48d1541f7c6225b63be2a9988a8e25a8e52c4838ff4cb4
45
# -- The flavour of tag you want to use
46
# There are different image flavours available, like distroless and ubi.
47
# Please see GitHub release notes for image tags for these flavors.
48
# By default, the distroless image is used.
49
flavour: ""
50
# -- If set, install and upgrade CRDs through helm chart.
51
installCRDs: true
52
crds:
53
# -- If true, create CRDs for Cluster External Secret. If set to false you must also set processClusterExternalSecret: false.
54
createClusterExternalSecret: true
55
# -- If true, create CRDs for Cluster Secret Store. If set to false you must also set processClusterStore: false.
56
createClusterSecretStore: true
57
# -- If true, create CRDs for Secret Store. If set to false you must also set processSecretStore: false.
58
createSecretStore: true
59
# -- If true, create CRDs for Cluster Generator. If set to false you must also set processClusterGenerator: false.
60
createClusterGenerator: true
61
# -- If true, create CRDs for Cluster Push Secret. If set to false you must also set processClusterPushSecret: false.
62
createClusterPushSecret: true
63
# -- If true, create CRDs for Push Secret. If set to false you must also set processPushSecret: false.
64
createPushSecret: true
65
annotations: {}
66
conversion:
67
# -- Conversion is disabled by default as we stopped supporting v1alpha1.
68
enabled: false
69
# -- If true, enable v1beta1 API version serving for ExternalSecret, ClusterExternalSecret, SecretStore, and ClusterSecretStore CRDs.
70
# v1beta1 is deprecated. Only enable this for backward compatibility if you have existing v1beta1 resources.
71
# Warning: This flag will be removed on 2026.05.01.
72
unsafeServeV1Beta1: false
73
imagePullSecrets: []
74
nameOverride: ""
75
fullnameOverride: ""
76
namespaceOverride: ""
77
# -- Additional labels added to all helm chart resources.
78
commonLabels: {}
79
# -- If true, external-secrets will perform leader election between instances to ensure no more
80
# than one instance of external-secrets operates at a time.
81
leaderElect: false
82
# -- ID of the lease object used for leader election.
83
# Leave empty to use the default ('external-secrets-controller').
84
# Set to a unique value when running multiple independent ESO deployments in the same namespace.
85
# @default -- "external-secrets-controller"
86
leaderElectionID: ""
87
# -- Duration that non-leader candidates will wait to force acquire leadership.
88
# Increase this along with renewDeadline to tolerate a busy or briefly unavailable API server
89
# (for example during control plane maintenance) without churning leadership.
90
# Leave empty to use the controller default ('15s').
91
# @default -- "15s"
92
leaderElectionLeaseDuration: ""
93
# -- Duration that the acting leader will retry refreshing leadership before giving up.
94
# Must be less than leaderElectionLeaseDuration.
95
# Leave empty to use the controller default ('10s').
96
# @default -- "10s"
97
leaderElectionRenewDeadline: ""
98
# -- Duration the leader election client waits between tries of actions.
99
# Leave empty to use the controller default ('2s').
100
# @default -- "2s"
101
leaderElectionRetryPeriod: ""
102
# -- If set external secrets will filter matching
103
# Secret Stores with the appropriate controller values.
104
controllerClass: ""
105
# -- If true external secrets will use recommended kubernetes
106
# annotations as prometheus metric labels.
107
extendedMetricLabels: false
108
# -- If set external secrets are only reconciled in the
109
# provided namespace
110
scopedNamespace: ""
111
# -- If true, create scoped RBAC roles and implicitly disable cluster-scoped
112
# controllers. Scoped to scopedNamespace if set, otherwise to .Release.Namespace.
113
scopedRBAC: false
114
# -- If true the OpenShift finalizer permissions will be added to RBAC
115
openshiftFinalizers: true
116
# -- If true the system:auth-delegator ClusterRole will be added to RBAC
117
systemAuthDelegator: false
118
# -- if true, the operator will process cluster external secret. Else, it will ignore them.
119
# When enabled, this adds update/patch permissions on namespaces to handle finalizers for proper
120
# cleanup during namespace deletion, preventing race conditions with ExternalSecrets.
121
processClusterExternalSecret: true
122
# -- if true, the operator will process cluster push secret. Else, it will ignore them.
123
processClusterPushSecret: true
124
# -- if true, the operator will process cluster store. Else, it will ignore them.
125
processClusterStore: true
126
# -- if true, the operator will process secret store. Else, it will ignore them.
127
processSecretStore: true
128
# -- Default time duration between reconciling (Cluster)SecretStores.
129
storeRequeueInterval: ""
130
# -- if true, the operator will process cluster generator. Else, it will ignore them.
131
processClusterGenerator: true
132
# -- if true, the operator will process push secret. Else, it will ignore them.
133
processPushSecret: true
134
# -- Enable support for generic targets (ConfigMaps, Custom Resources).
135
# Warning: Using generic target. Make sure access policies and encryption are properly configured.
136
# When enabled, this grants the controller permissions to create/update/delete
137
# ConfigMaps and optionally other resource types specified in generic.resources.
138
genericTargets:
139
# -- Enable generic target support
140
enabled: false
141
# -- List of additional resource types to grant permissions for.
142
# Each entry should specify apiGroup, resources, and verbs.
143
# Example:
144
# resources:
145
# - apiGroup: "argoproj.io"
146
# resources: ["applications"]
147
# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
148
resources: []
149
# -- Specifies whether an external secret operator deployment be created.
150
createOperator: true
151
# -- if true, HTTP2 will be enabled for the services created by all controllers, curently metrics and webhook.
152
enableHTTP2: false
153
# -- TLS security profile settings applied to all controller, webhook, and certController deployments.
154
# These can be overridden per-component via webhook.tls and certController.tls.
155
tls:
156
# -- Minimum TLS version supported (e.g. "1.2" or "1.3"). If empty, the Go CLI default applies.
157
# +docs:property
158
minVersion: ""
159
# -- Comma-separated list of TLS cipher suites (TLS_CIPHER_SUITE names).
160
# Does not apply to TLS 1.3. If empty, Go defaults apply.
161
# +docs:property
162
ciphers: ""
163
# -- Ordered list of TLS key exchange curves (e.g. X25519, CurveP256, or decimal CurveID).
164
# If empty, Go defaults apply.
165
# +docs:property
166
curvePreferences: []
167
# -- Vault token cache configuration
168
vault:
169
# -- Enable Vault token cache. External secrets will reuse the Vault token without creating a new one on each request.
170
enableTokenCache: false
171
# -- Maximum size of Vault token cache. Only used if enableTokenCache is true.
172
tokenCacheSize: 262144
173
# -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at
174
# a time.
175
concurrent: 1
176
# -- Specifies Log Params to the External Secrets Operator
177
log:
178
level: info
179
timeEncoding: epoch
180
service:
181
# -- Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
182
ipFamilyPolicy: ""
183
# -- Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
184
ipFamilies: []
185
serviceAccount:
186
# -- Specifies whether a service account should be created.
187
create: true
188
# -- Automounts the service account token in all containers of the pod
189
automount: true
190
# -- Annotations to add to the service account.
191
annotations: {}
192
# -- Extra Labels to add to the service account.
193
extraLabels: {}
194
# -- The name of the service account to use.
195
# If not set and create is true, a name is generated using the fullname template.
196
name: ""
197
rbac:
198
# -- Specifies whether role and rolebinding resources should be created.
199
create: true
200
# -- Specifies whether the serviceaccounts/token create permission is included in the controller RBAC.
201
# When set to false, users must create per-ServiceAccount Role/RoleBinding with resourceNames constraint
202
# to grant ESO token creation for specific ServiceAccounts referenced in SecretStore specs.
203
serviceAccountTokenCreate: true
204
servicebindings:
205
# -- Specifies whether a clusterrole to give servicebindings read access should be created.
206
create: true
207
# -- Specifies whether permissions are aggregated to the view ClusterRole
208
aggregateToView: true
209
# -- Specifies whether permissions are aggregated to the edit ClusterRole
210
aggregateToEdit: true
211
# -- Specifies whether permissions are aggregated to the admin ClusterRole
212
aggregateToAdmin: true
213
## -- Extra environment variables to add to container.
214
extraEnv: []
215
## -- Map of extra arguments to pass to container.
216
extraArgs: {}
217
## -- Extra volumes to pass to pod.
218
extraVolumes: []
219
## -- Extra Kubernetes objects to deploy with the helm chart
220
extraObjects: []
221
## -- Extra volumes to mount to the container.
222
extraVolumeMounts: []
223
## -- Extra init containers to add to the pod.
224
extraInitContainers: []
225
## -- Extra containers to add to the pod.
226
extraContainers: []
227
# -- Annotations to add to Deployment
228
deploymentAnnotations: {}
229
# -- Set deployment strategy
230
strategy: {}
231
# -- Annotations to add to Pod
232
podAnnotations: {}
233
podLabels: {}
234
podSecurityContext:
235
enabled: true
236
# fsGroup: 2000
237
securityContext:
238
allowPrivilegeEscalation: false
239
capabilities:
240
drop:
241
- ALL
242
enabled: true
243
readOnlyRootFilesystem: true
244
runAsNonRoot: true
245
runAsUser: 1000
246
seccompProfile:
247
type: RuntimeDefault
248
resources: {}
249
# requests:
250
# cpu: 10m
251
# memory: 32Mi
252
253
serviceMonitor:
254
# -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
255
enabled: false
256
# -- How should we react to missing CRD "`monitoring.coreos.com/v1/ServiceMonitor`"
257
#
258
# Possible values:
259
# - `skipIfMissing`: Only render ServiceMonitor resources if CRD is present, skip if missing.
260
# - `failIfMissing`: Fail Helm install if CRD is not present.
261
# - `alwaysRender` : Always render ServiceMonitor resources, do not check for CRD.
262
263
# @schema
264
# enum:
265
# - skipIfMissing
266
# - failIfMissing
267
# - alwaysRender
268
# @schema
269
renderMode: skipIfMissing # @schema enum: [skipIfMissing, failIfMissing, alwaysRender]
270
# -- namespace where you want to install ServiceMonitors
271
namespace: ""
272
# -- Additional labels
273
additionalLabels: {}
274
# -- Interval to scrape metrics
275
interval: 30s
276
# -- Timeout if metrics can't be retrieved in given time interval
277
scrapeTimeout: 25s
278
# -- Let prometheus add an exported_ prefix to conflicting labels
279
honorLabels: false
280
# -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)
281
metricRelabelings: []
282
# - action: replace
283
# regex: (.*)
284
# replacement: $1
285
# sourceLabels:
286
# - exported_namespace
287
# targetLabel: namespace
288
289
# -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)
290
relabelings: []
291
# - sourceLabels: [__meta_kubernetes_pod_node_name]
292
# separator: ;
293
# regex: ^(.*)$
294
# targetLabel: nodename
295
# replacement: $1
296
# action: replace
297
metrics:
298
listen:
299
port: 8080
300
auth:
301
# -- Enable Kubernetes RBAC-based authentication for metrics endpoint. Requires metrics.listen.secure to be true. Default value is false.
302
enabled: false
303
secure:
304
enabled: false
305
# -- if those are not set or invalid, self-signed certs will be generated
306
# -- TLS cert directory path
307
certDir: /etc/tls
308
# -- TLS cert file path
309
certFile: /etc/tls/tls.crt
310
# -- TLS key file path
311
keyFile: /etc/tls/tls.key
312
service:
313
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
314
enabled: false
315
# -- Metrics service port to scrape
316
port: 8080
317
# -- Additional service annotations
318
annotations: {}
319
grafanaDashboard:
320
# -- If true creates a Grafana dashboard.
321
enabled: false
322
# -- Label that ConfigMaps should have to be loaded as dashboards.
323
sidecarLabel: "grafana_dashboard"
324
# -- Label value that ConfigMaps should have to be loaded as dashboards.
325
sidecarLabelValue: "1"
326
# -- Annotations that ConfigMaps can have to get configured in Grafana,
327
# See: sidecar.dashboards.folderAnnotation for specifying the dashboard folder.
328
# https://github.com/grafana/helm-charts/tree/main/charts/grafana
329
annotations: {}
330
# -- Extra labels to add to the Grafana dashboard ConfigMap.
331
extraLabels: {}
332
livenessProbe:
333
# -- Enabled determines if the liveness probe should be used or not. By default it's disabled.
334
enabled: false
335
# -- The body of the liveness probe settings.
336
spec:
337
# -- Bind address for the health server used by both liveness and readiness probes (--live-addr flag).
338
address: ""
339
# -- Port for the health server used by both liveness and readiness probes (--live-addr flag).
340
port: 8082
341
# -- Specify the maximum amount of time to wait for a probe to respond before considering it fails.
342
timeoutSeconds: 5
343
# -- Number of consecutive probe failures that should occur before considering the probe as failed.
344
failureThreshold: 5
345
# -- Period in seconds for K8s to start performing probes.
346
periodSeconds: 10
347
# -- Number of successful probes to mark probe successful.
348
successThreshold: 1
349
# -- Delay in seconds for the container to start before performing the initial probe.
350
initialDelaySeconds: 10
351
# -- Handler for liveness probe.
352
httpGet:
353
# -- Set this value to 'live' (for named port) or an an integer for liveness probes.
354
# @schema type: [string, integer]
355
port: live
356
# -- Path for liveness probe.
357
path: /healthz
358
readinessProbe:
359
# -- Determines whether the readiness probe is enabled. Disabled by default. Enabling this will auto-start the health server (--live-addr) even if livenessProbe is disabled. Health server address/port are configured via livenessProbe.spec.address and livenessProbe.spec.port.
360
enabled: false
361
# -- The body of the readiness probe settings (standard Kubernetes probe spec).
362
spec:
363
# -- Specify the maximum amount of time to wait for a probe to respond before considering it fails.
364
timeoutSeconds: 5
365
# -- Number of consecutive probe failures that should occur before considering the probe as failed.
366
failureThreshold: 3
367
# -- Period in seconds for K8s to start performing probes.
368
periodSeconds: 10
369
# -- Number of successful probes to mark probe successful.
370
successThreshold: 1
371
# -- Delay in seconds for the container to start before performing the initial probe.
372
initialDelaySeconds: 10
373
# -- Handler for readiness probe.
374
httpGet:
375
# -- Set this value to 'live' (for named port) or an integer for readiness probes.
376
# @schema type: [string, integer]
377
port: live
378
# -- Path for readiness probe.
379
path: /readyz
380
nodeSelector: {}
381
tolerations: []
382
topologySpreadConstraints: []
383
affinity: {}
384
# -- Pod priority class name.
385
priorityClassName: ""
386
# -- Pod scheduler name.
387
schedulerName: ""
388
# -- Pod runtime class name.
389
runtimeClassName: ""
390
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
391
podDisruptionBudget:
392
enabled: false
393
minAvailable: 1 # @schema type:[integer, string]
394
nameOverride: ""
395
# maxUnavailable: "50%"
396
# -- Run the controller on the host network
397
hostNetwork: false
398
# -- (bool) Specifies if controller pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
399
# @schema type: [boolean, null]
400
hostUsers:
401
# -- Setup a networkPolicy for external-secrets
402
networkPolicy:
403
# -- Specifies whether the networkPolicy should be created.
404
enabled: false
405
# -- The ingress traffic
406
# Should match the health and (optionally) metrics port
407
ingress:
408
- ports:
409
- protocol: TCP
410
# @schema type: [string, integer]
411
port: 8080 # metrics port
412
- protocol: TCP
413
# @schema type: [string, integer]
414
port: 8082 # health port
415
# -- The egress traffic
416
# The minimum egress ports required to function are:
417
# DNS (53/udp, 53/tcp)
418
# API server (80/tcp, 443/tcp, or 6443/tcp)
419
# You will need to customize this value to meet your needs
420
egress: []
421
webhook:
422
# -- Annotations to place on validating webhook configuration.
423
annotations: {}
424
# -- Specifies whether a webhook deployment be created. If set to false, crds.conversion.enabled should also be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint.
425
create: true
426
# -- Specifies the time to check if the cert is valid
427
certCheckInterval: "5m"
428
# -- Specifies the lookaheadInterval for certificate validity
429
lookaheadInterval: ""
430
replicaCount: 1
431
# -- Specifies Log Params to the Webhook
432
log:
433
level: info
434
timeEncoding: epoch
435
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
436
revisionHistoryLimit: 10
437
certDir: /tmp/certs
438
# -- Webhook-specific TLS security profile overrides.
439
# When set, these override the global tls.* values for the webhook deployment.
440
tls:
441
# -- Minimum TLS version supported (e.g. "1.2" or "1.3"). If empty, the global tls.minVersion is used.
442
# +docs:property
443
minVersion: ""
444
# -- Comma-separated list of TLS cipher suites. If empty, the global tls.ciphers is used.
445
# +docs:property
446
ciphers: ""
447
# -- Ordered list of TLS key exchange curves. If empty, the global tls.curvePreferences is used.
448
# +docs:property
449
curvePreferences: []
450
# -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
451
failurePolicy: Fail
452
# -- Specifies if webhook pod should use hostNetwork or not.
453
hostNetwork: false
454
# -- (bool) Specifies if webhook pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
455
# @schema type: [boolean, null]
456
hostUsers:
457
# -- Setup a networkPolicy for external-secrets webhook
458
networkPolicy:
459
# -- Specifies whether the networkPolicy should be created.
460
enabled: false
461
# -- The ingress traffic
462
# Should match the webhook, health, and (optionally) metrics port
463
ingress:
464
- ports:
465
- protocol: TCP
466
# @schema type: [string, integer]
467
port: 8080 # metrics port
468
- protocol: TCP
469
# @schema type: [string, integer]
470
port: 8081 # health port
471
- protocol: TCP
472
# @schema type: [string, integer]
473
port: 10250 # webhook port
474
# -- The egress traffic
475
# The minimum egress ports required to function are:
476
# DNS (53/udp, 53/tcp)
477
# API server (80/tcp, 443/tcp, or 6443/tcp)
478
# You will need to customize this value to meet your needs
479
egress: []
480
image:
481
repository: cgr.dev/chainguard-private/external-secrets-fips
482
pullPolicy: IfNotPresent
483
# -- The image tag to use. The default is the chart appVersion.
484
tag: 2.9.0@sha256:316ca23eec3d8eb5af48d1541f7c6225b63be2a9988a8e25a8e52c4838ff4cb4
485
# -- The flavour of tag you want to use
486
flavour: ""
487
imagePullSecrets: []
488
# -- The port the webhook will listen to
489
port: 10250
490
serviceAccount:
491
# -- Specifies whether a service account should be created.
492
create: true
493
# -- Automounts the service account token in all containers of the pod
494
automount: true
495
# -- Annotations to add to the service account.
496
annotations: {}
497
# -- Extra Labels to add to the service account.
498
extraLabels: {}
499
# -- The name of the service account to use.
500
# If not set and create is true, a name is generated using the fullname template.
501
name: ""
502
nodeSelector: {}
503
# -- Specifies `hostAliases` to webhook deployment
504
hostAliases: []
505
certManager:
506
# -- Enabling cert-manager support will disable the built in secret and
507
# switch to using cert-manager (installed separately) to automatically issue
508
# and renew the webhook certificate. This chart does not install
509
# cert-manager for you, See https://cert-manager.io/docs/
510
enabled: false
511
# -- Automatically add the cert-manager.io/inject-ca-from annotation to the
512
# webhooks and CRDs. As long as you have the cert-manager CA Injector
513
# enabled, this will automatically setup your webhook's CA to the one used
514
# by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector
515
addInjectorAnnotations: true
516
cert:
517
# -- Create a certificate resource within this chart. See
518
# https://cert-manager.io/docs/usage/certificate/
519
create: true
520
# -- For the Certificate created by this chart, setup the issuer. See
521
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec
522
issuerRef:
523
group: cert-manager.io
524
kind: "Issuer"
525
name: "my-issuer"
526
# -- Set the requested duration (i.e. lifetime) of the Certificate. See
527
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
528
# One year by default.
529
duration: "8760h0m0s"
530
# -- Set the revisionHistoryLimit on the Certificate. See
531
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
532
# Defaults to 0 (ignored).
533
revisionHistoryLimit: 0
534
# -- How long before the currently issued certificate’s expiry
535
# cert-manager should renew the certificate. See
536
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
537
# Note that renewBefore should be greater than .webhook.lookaheadInterval
538
# since the webhook will check this far in advance that the certificate is
539
# valid.
540
renewBefore: ""
541
# -- Specific settings on the privateKey and its generation
542
privateKey: {}
543
# rotationPolicy: Always
544
# algorithm: RSA
545
# size: 2048
546
# -- Specific settings on the signatureAlgorithm used on the cert.
547
# signatureAlgorithm is only valid for cert-manager v1.18.0+
548
signatureAlgorithm: ""
549
# -- Add extra annotations to the Certificate resource.
550
annotations: {}
551
tolerations: []
552
topologySpreadConstraints: []
553
affinity: {}
554
# -- Set deployment strategy
555
strategy: {}
556
# -- Pod priority class name.
557
priorityClassName: ""
558
# -- Pod scheduler name.
559
schedulerName: ""
560
# -- Pod runtime class name.
561
runtimeClassName: ""
562
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
563
podDisruptionBudget:
564
enabled: false
565
minAvailable: 1 # @schema type:[integer, string]
566
nameOverride: ""
567
# maxUnavailable: "50%"
568
metrics:
569
listen:
570
port: 8080
571
auth:
572
# -- Enable Kubernetes RBAC-based authentication for webhook's metrics endpoint. Requires webhook.metrics.listen.secure to be true. Default value is false.
573
enabled: false
574
secure:
575
enabled: false
576
# -- if those are not set or invalid, self-signed certs will be generated
577
# -- TLS cert directory path
578
certDir: /etc/tls
579
# -- TLS cert file path
580
certFile: /etc/tls/tls.crt
581
# -- TLS key file path
582
keyFile: /etc/tls/tls.key
583
service:
584
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
585
enabled: false
586
# -- Metrics service port to scrape
587
port: 8080
588
# -- Additional service annotations
589
annotations: {}
590
livenessProbe:
591
enabled: false
592
# -- Set this value to 'live' (for named port) or an integer for liveness probes.
593
# @schema type: [string, integer]
594
port: 8081
595
timeoutSeconds: 5
596
failureThreshold: 5
597
periodSeconds: 10
598
successThreshold: 1
599
initialDelaySeconds: 10
600
readinessProbe:
601
enabled: true
602
address: ""
603
# -- Set this value to 'ready' (for named port) or an integer for readiness probes.
604
# @schema type: [string, integer]
605
port: 8081
606
timeoutSeconds: 5
607
failureThreshold: 3
608
periodSeconds: 5
609
successThreshold: 1
610
initialDelaySeconds: 20
611
startupProbe:
612
# -- Enabled determines if the startup probe should be used or not. By default it's disabled.
613
enabled: false
614
# -- Number of seconds after the container has started before the startup probe is initiated.
615
initialDelaySeconds: 10
616
# -- How often (in seconds) to perform the startup probe.
617
periodSeconds: 10
618
# -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds.
619
failureThreshold: 30
620
## -- Extra environment variables to add to container.
621
extraEnv: []
622
## -- Map of extra arguments to pass to container.
623
extraArgs: {}
624
## -- Extra init containers to add to the pod.
625
extraInitContainers: []
626
## -- Extra volumes to pass to pod.
627
extraVolumes: []
628
## -- Extra volumes to mount to the container.
629
extraVolumeMounts: []
630
# -- Annotations to add to Secret
631
secretAnnotations: {}
632
# -- Annotations to add to Deployment
633
deploymentAnnotations: {}
634
# -- Annotations to add to Pod
635
podAnnotations: {}
636
podLabels: {}
637
podSecurityContext:
638
enabled: true
639
# fsGroup: 2000
640
securityContext:
641
allowPrivilegeEscalation: false
642
capabilities:
643
drop:
644
- ALL
645
enabled: true
646
readOnlyRootFilesystem: true
647
runAsNonRoot: true
648
runAsUser: 1000
649
seccompProfile:
650
type: RuntimeDefault
651
resources: {}
652
# requests:
653
# cpu: 10m
654
# memory: 32Mi
655
656
# -- Manage the service through which the webhook is reached.
657
service:
658
# -- Whether the service object should be enabled or not (it is expected to exist).
659
enabled: true
660
# -- Custom annotations for the webhook service.
661
annotations: {}
662
# -- Custom labels for the webhook service.
663
labels: {}
664
# -- The service type of the webhook service.
665
type: ClusterIP
666
# -- If the webhook service type is LoadBalancer, you can assign a specific load balancer IP here.
667
# Check the documentation of your load balancer provider to see if/how this should be used.
668
loadBalancerIP: ""
669
certController:
670
# -- Specifies whether a certificate controller deployment be created.
671
create: true
672
requeueInterval: "5m"
673
replicaCount: 1
674
# -- Restrict the cert controller's informer cache to CustomResourceDefinitions and
675
# ValidatingWebhookConfigurations carrying the `external-secrets.io/component` label.
676
# Disable this only if the CRDs it manages were installed without that label.
677
enablePartialCache: true
678
# -- Specifies Log Params to the Certificate Controller
679
log:
680
level: info
681
timeEncoding: epoch
682
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
683
revisionHistoryLimit: 10
684
# -- CertController-specific TLS security profile overrides.
685
# When set, these override the global tls.* values for the cert-controller deployment.
686
tls:
687
# -- Minimum TLS version supported (e.g. "1.2" or "1.3"). If empty, the global tls.minVersion is used.
688
# +docs:property
689
minVersion: ""
690
# -- Comma-separated list of TLS cipher suites. If empty, the global tls.ciphers is used.
691
# +docs:property
692
ciphers: ""
693
# -- Ordered list of TLS key exchange curves. If empty, the global tls.curvePreferences is used.
694
# +docs:property
695
curvePreferences: []
696
image:
697
repository: cgr.dev/chainguard-private/external-secrets-fips
698
pullPolicy: IfNotPresent
699
tag: 2.9.0@sha256:316ca23eec3d8eb5af48d1541f7c6225b63be2a9988a8e25a8e52c4838ff4cb4
700
flavour: ""
701
imagePullSecrets: []
702
rbac:
703
# -- Specifies whether role and rolebinding resources should be created.
704
create: true
705
serviceAccount:
706
# -- Specifies whether a service account should be created.
707
create: true
708
# -- Automounts the service account token in all containers of the pod
709
automount: true
710
# -- Annotations to add to the service account.
711
annotations: {}
712
# -- Extra Labels to add to the service account.
713
extraLabels: {}
714
# -- The name of the service account to use.
715
# If not set and create is true, a name is generated using the fullname template.
716
name: ""
717
nodeSelector: {}
718
# -- Specifies `hostAliases` to cert-controller deployment
719
hostAliases: []
720
tolerations: []
721
topologySpreadConstraints: []
722
affinity: {}
723
# -- Set deployment strategy
724
strategy: {}
725
# -- Run the certController on the host network
726
hostNetwork: false
727
# -- (bool) Specifies if certController pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
728
# @schema type: [boolean, null]
729
hostUsers:
730
# -- Setup a networkPolicy for external-secrets certController
731
networkPolicy:
732
# -- Specifies whether the networkPolicy should be created.
733
enabled: false
734
# -- The ingress traffic
735
# Should match the health and (optionally) metrics port
736
ingress:
737
- ports:
738
- protocol: TCP
739
# @schema type: [string, integer]
740
port: 8080 # metrics port
741
- protocol: TCP
742
# @schema type: [string, integer]
743
port: 8081 # health port
744
# -- The egress traffic
745
# The minimum egress ports required to function are:
746
# DNS (53/udp, 53/tcp)
747
# API server (80/tcp, 443/tcp, or 6443/tcp)
748
# You will need to customize this value to meet your needs
749
egress: []
750
# -- Pod priority class name.
751
priorityClassName: ""
752
# -- Pod scheduler name.
753
schedulerName: ""
754
# -- Pod runtime class name.
755
runtimeClassName: ""
756
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
757
podDisruptionBudget:
758
enabled: false
759
minAvailable: 1 # @schema type:[integer, string]
760
nameOverride: ""
761
# maxUnavailable: "50%"
762
metrics:
763
listen:
764
port: 8080
765
auth:
766
# -- Enable Kubernetes RBAC-based authentication for certController's metrics endpoint. Requires certController.metrics.listen.secure to be true. Default value is false.
767
enabled: false
768
secure:
769
enabled: false
770
# -- if those are not set or invalid, self-signed certs will be generated
771
# -- TLS cert directory path
772
certDir: /etc/tls
773
# -- TLS cert file path
774
certFile: /etc/tls/tls.crt
775
# -- TLS key file path
776
keyFile: /etc/tls/tls.key
777
service:
778
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
779
enabled: false
780
# -- Metrics service port to scrape
781
port: 8080
782
# -- Additional service annotations
783
annotations: {}
784
livenessProbe:
785
enabled: false
786
# -- Set this value to 'live' (for named port) or an integer for liveness probes.
787
# @schema type: [string, integer]
788
port: 8081
789
timeoutSeconds: 5
790
failureThreshold: 5
791
periodSeconds: 10
792
successThreshold: 1
793
initialDelaySeconds: 10
794
readinessProbe:
795
enabled: true
796
address: ""
797
# -- Set this value to 'ready' (for named port) or an integer for readiness probes.
798
# @schema type: [string, integer]
799
port: 8081
800
timeoutSeconds: 5
801
failureThreshold: 3
802
periodSeconds: 5
803
successThreshold: 1
804
initialDelaySeconds: 20
805
startupProbe:
806
# -- Enabled determines if the startup probe should be used or not. By default it's disabled.
807
enabled: false
808
# -- Number of seconds after the container has started before the startup probe is initiated.
809
initialDelaySeconds: 10
810
# -- How often (in seconds) to perform the startup probe.
811
periodSeconds: 10
812
# -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds.
813
failureThreshold: 30
814
## -- Extra environment variables to add to container.
815
extraEnv: []
816
## -- Map of extra arguments to pass to container.
817
extraArgs: {}
818
## -- Extra init containers to add to the pod.
819
extraInitContainers: []
820
## -- Extra volumes to pass to pod.
821
extraVolumes: []
822
## -- Extra volumes to mount to the container.
823
extraVolumeMounts: []
824
# -- Annotations to add to Deployment
825
deploymentAnnotations: {}
826
# -- Annotations to add to Pod
827
podAnnotations: {}
828
podLabels: {}
829
podSecurityContext:
830
enabled: true
831
# fsGroup: 2000
832
securityContext:
833
allowPrivilegeEscalation: false
834
capabilities:
835
drop:
836
- ALL
837
enabled: true
838
readOnlyRootFilesystem: true
839
runAsNonRoot: true
840
runAsUser: 1000
841
seccompProfile:
842
type: RuntimeDefault
843
resources: {}
844
# requests:
845
# cpu: 10m
846
# memory: 32Mi
847
# -- Specifies `dnsPolicy` to deployment
848
dnsPolicy: ClusterFirst
849
# -- Specifies `dnsOptions` to deployment
850
dnsConfig: {}
851
# -- Specifies `hostAliases` to deployment
852
hostAliases: []
853
# -- Any extra pod spec on the deployment
854
podSpecExtra: {}
855
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.