PushSecret is the Schema for the PushSecrets API that enables pushing Kubernetes secrets to external secret providers.
5 top-level fields · last changed in External Secrets Operator v2.9.0
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
PushSecretSpec configures the behavior of the PushSecret.
Secret Data that should be pushed to providers
Used to define a conversion Strategy for the secret keys
Match a given Secret Key to be pushed to the provider.
Remote Refs to push to providers.
Name of the property in the resulting secret
Name of the resulting provider secret.
Secret Key to be pushed
Metadata is metadata attached to the secret. The structure of metadata is provider specific, please look it up in the provider documentation.
DataTo defines bulk push rules that expand source Secret keys into provider entries.
Used to define a conversion Strategy for the secret keys
Match pattern for selecting keys from the source Secret. If not specified, all keys are selected.
Regexp matches keys by regular expression. If not specified, all keys are matched.
Metadata is metadata attached to the secret. The structure of metadata is provider specific, please look it up in the provider documentation.
RemoteKey is the name of the single provider secret that will receive ALL matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}). When set, per-key expansion is skipped and a single push is performed. The provider's store prefix (if any) is still prepended to this value. When not set, each matched key is pushed as its own individual provider secret.
Rewrite operations to transform keys before pushing to the provider. Operations are applied sequentially.
Used to rewrite with regular expressions.
Used to define the regular expression of a re.Compiler.
Used to define the target pattern of a ReplaceAll operation.
Used to apply string transformation on the secrets.
Used to define the template to apply on the secret name. `.value ` will specify the secret name in the template.
StoreRef specifies which SecretStore to push to. Required.
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Optionally, sync to secret stores with label selector
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Optionally, sync to the SecretStore of the given name
Deletion Policy to handle Secrets in the provider.
The Interval to which External Secrets will try to push a secret definition
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Optionally, sync to secret stores with label selector
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Optionally, sync to the SecretStore of the given name
The Secret Selector (k8s source) for the Push Secret
Point to a generator to create a Secret.
Specify the apiVersion of the generator resource
Specify the Kind of the generator resource
Specify the name of the generator resource
Select a Secret to Push.
Name of the Secret. The Secret must exist in the same namespace as the PushSecret manifest.
Selector chooses secrets using a labelSelector.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Template defines a blueprint for the created Secret resource.
EngineVersion specifies the template engine version that should be used to compile/execute the template specified in .data and .templateFrom[].
TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
A list of keys in the ConfigMap/Secret to use as templates for Secret data
A key in the ConfigMap/Secret
TemplateScope specifies how the template keys should be interpreted.
The name of the ConfigMap/Secret resource
TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
A list of keys in the ConfigMap/Secret to use as templates for Secret data
A key in the ConfigMap/Secret
TemplateScope specifies how the template keys should be interpreted.
The name of the ConfigMap/Secret resource
Target specifies where to place the template result. For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data".
Used to define a decoding Strategy for the rendered template values. Defaults to None when omitted.
UpdatePolicy to handle Secrets in the provider.
PushSecretStatus indicates the history of the status of PushSecret.
PushSecretConditionType indicates the condition of the PushSecret.
refreshTime is the time and date the external secret was fetched and the target secret updated
Synced PushSecrets, including secrets that already exist in provider. Matches secret stores to PushSecretData that was stored to that secret store.
Used to define a conversion Strategy for the secret keys
Match a given Secret Key to be pushed to the provider.
Remote Refs to push to providers.
Name of the property in the resulting secret
Name of the resulting provider secret.
Secret Key to be pushed
Metadata is metadata attached to the secret. The structure of metadata is provider specific, please look it up in the provider documentation.
SyncedResourceVersion keeps track of the last synced version.
Source: bundle.yaml
Changes to PushSecret (external-secrets.io/v1alpha1) in each External Secrets Operator version, compared to the version before it.
2 properties have changed the description
Released · View PushSecret in v2.9.0
1 property has been added
Released · View PushSecret in v2.7.0
1 property has been added
Released · View PushSecret in v2.3.0
1 property has changed the description
Released · View PushSecret in v1.0.0
The description of PushSecret has changed
6 properties have changed the description
Released · View PushSecret in v0.20.4
1 property has been added
Released · View PushSecret in v0.20.0
11 properties have changed the description
Released · View PushSecret in v0.11.0
2 properties have been added
Released · View PushSecret in v0.9.15
1 property has been added
1 property has changed the description
Released · View PushSecret in v0.9.14
10 properties have changed the description
Released · View PushSecret in v0.9.12
1 property has been added
Released · View PushSecret in v0.9.11
2 properties are no longer required
Released · View PushSecret in v0.9.10
2 properties have been added
Released · View PushSecret in v0.9.5
7 properties have changed the description
Released · View PushSecret in v0.9.0
7 properties have changed the description
Released · View PushSecret in v0.8.12
2 properties have been added
Released · View PushSecret in v0.8.2
2 properties have been removed
Released · View PushSecret in v0.8.0
2 properties have been added
Released · View PushSecret in v0.7.3
PushSecret was first seen on this version of External Secrets Operator
Released · View PushSecret in v0.7.0
No examples of PushSecret yet. Contribute one on GitHub.
kubespec.dev