external-secrets values.yaml¶
istio.enabled¶
Type: bool
false
istio.sidecar.enabled¶
Type: bool
false
istio.sidecar.outboundTrafficPolicyMode¶
Type: string
"REGISTRY_ONLY"
istio.serviceEntries.custom¶
Type: list
[]
istio.authorizationPolicies.enabled¶
Type: bool
false
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.enabled¶
Type: bool
false
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.spec.selector.matchLabels.”app.kubernetes.io/name”¶
Type: string
"external-secrets-webhook"
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.spec.rules[0].from[0].source.ipBlocks[0]¶
Type: string
"10.0.0.0/8"
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.spec.rules[0].from[0].source.ipBlocks[1]¶
Type: string
"172.16.0.0/12"
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.spec.rules[0].from[0].source.ipBlocks[2]¶
Type: string
"192.168.0.0/16"
istio.authorizationPolicies.additionalPolicies.allow-ingress-to-external-secrets-webhook-tcp-port-10250-from-kube-api.spec.rules[0].to[0].operation.ports[0]¶
Type: string
"10250"
istio.mtls.mode¶
Type: string
"STRICT"
networkPolicies.enabled¶
Type: bool
false
networkPolicies.ingress.to.external-secrets-webhook:10250.from.definition.kubeAPI¶
Type: bool
false
networkPolicies.egress.definitions.secrets-api-subnets.to[0].ipBlock.cidr¶
Type: string
"0.0.0.0/0"
networkPolicies.egress.definitions.secrets-api-subnets.to[0].ipBlock.except[0]¶
Type: string
"169.254.169.254/32"
networkPolicies.egress.definitions.secrets-api-subnets.ports[0].port¶
Type: int
443
networkPolicies.egress.definitions.secrets-api-subnets.ports[0].protocol¶
Type: string
"TCP"
networkPolicies.egress.from.external-secrets.to.k8s.vault/vault:8200¶
Type: bool
false
networkPolicies.egress.from.external-secrets.to.definition.kubeAPI¶
Type: bool
true
networkPolicies.egress.from.external-secrets.to.definition.secrets-api-subnets¶
Type: bool
true
networkPolicies.egress.from.external-secrets-webhook.to.definition.kubeAPI¶
Type: bool
false
networkPolicies.egress.from.external-secrets-cert-controller.to.definition.kubeAPI¶
Type: bool
false
bbtests.enabled¶
Type: bool
false
bbtests.namespace¶
Type: string
"external-secrets"
bbtests.scripts.image¶
Type: string
"registry1.dso.mil/ironbank/big-bang/base:2.1.0"
bbtests.secretMount.image¶
Type: string
"registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal:9.8"
bbtests.secretstore.name¶
Type: string
"external-secrets-test-store"
bbtests.serviceaccount.name¶
Type: string
"external-secrets-external-secrets-script-sa"
bbtests.secrets.testsecret.value¶
Type: string
"this is a magic value"
env.EXTERNAL_SECRETS_NAMESPACE¶
Type: string
"external-secrets"
clusterSecretStoreConfiguration.enabled¶
Type: bool
false
clusterSecretStoreConfiguration.clusterSecretStoreList[0].name¶
Type: string
""
clusterSecretStoreConfiguration.clusterSecretStoreList[0].namespace¶
Type: string
""
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source¶
Type: object
auth:
accessKeyID: ''
accessKeyName: ''
authType: ''
secretAccessKey: ''
provider: aws
region: us-gov-west-1
service: SecretsManager
Description: define types of authentication: ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.provider¶
Type: string
"aws"
Description: Supported providers: aws, vault ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.service¶
Type: string
"SecretsManager"
Description: Specify type of service, i.e., SecretsManager (default) ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.region¶
Type: string
"us-gov-west-1"
Description: Specify AWS region, i.e. us-gov-west-1 (default) ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.auth.authType¶
Type: string
""
Description: Specify authType is required: identity, accesskey or serviceaccount ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.auth.accessKeyName¶
Type: string
""
Description: Name of the accessKeyID and secretAccessKey pair ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.auth.accessKeyID¶
Type: string
""
Description: Specify AWS Access Key ID file ##
clusterSecretStoreConfiguration.clusterSecretStoreList[0].source.auth.secretAccessKey¶
Type: string
""
Description: Specify AWS Secret Access Key file ##
externalSecretsConfiguration.enabled¶
Type: bool
false
externalSecretsConfiguration.secretList[0].name¶
Type: string
""
externalSecretsConfiguration.secretList[0].namespace¶
Type: string
""
externalSecretsConfiguration.secretList[0].refreshInterval¶
Type: string
""
externalSecretsConfiguration.secretList[0].secrets.targetName¶
Type: string
""
externalSecretsConfiguration.secretList[0].secrets.targetPolicy¶
Type: string
"Owner"
upstream.podLabels¶
Type: object
vault-ingress: 'true'
Description: Pod labels applied to ESO pods. vault-ingress=true allows traffic through Vault’s default ingress NetworkPolicy (allow-ingress-to-vault-port-8200-from-custom-app-ingress)
upstream.image.tag¶
Type: string
"v2.10.0"
Description: The image tag to use. The default is the chart appVersion.