cyberark-secrets-provider-for-k8s
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Values for secrets-provider. All missing values need to be supplied by the customer.
2
3
# Container mode: "application" (default) or "standalone"
4
# When "application", runs as a Job and populates configured Kubernetes secrets on completion.
5
# When "standalone", runs as a Deployment and uses label-based secret discovery across namespaces plus secrets rotation.
6
containerMode: application
7
# Standalone mode settings (only apply when containerMode is "standalone")
8
standalone:
9
# Namespace allowlist. Optional; when empty, uses the deployment namespace (current namespace).
10
# Use "*" for all namespaces, or comma-separated list (e.g. "ns1,ns2,ns3").
11
# When "*" or multiple namespaces, RBAC requires a ClusterRole for cluster-wide secret access.
12
namespaceAllowlist: ""
13
secretsRefreshEnabled: true
14
secretsRefreshInterval: "5m"
15
removeDeletedSecretsEnabled: true
16
# Probe configuration for the standalone deployment.
17
probes:
18
port: 8080
19
portName: probes
20
livenessPath: /healthz
21
readinessPath: /readyz
22
livenessProbe:
23
initialDelaySeconds: 5
24
periodSeconds: 10
25
timeoutSeconds: 1
26
failureThreshold: 3
27
successThreshold: 1
28
readinessProbe:
29
initialDelaySeconds: 5
30
periodSeconds: 5
31
timeoutSeconds: 1
32
failureThreshold: 3
33
successThreshold: 1
34
rbac:
35
# Indicates whether the Secrets Provider service account, Role, and RoleBinding should be created. This should be set
36
# to true unless resources with the proper permissions exist in the namespace/cluster.
37
create: true
38
roleName: secrets-provider-role
39
roleBindingName: secrets-provider-role-binding
40
# ClusterRole/ClusterRoleBinding names (used when standalone.namespaceAllowlist is "*" or includes multiple namespaces)
41
clusterRoleName: secrets-provider-cluster-role
42
clusterRoleBindingName: secrets-provider-cluster-role-binding
43
serviceAccount:
44
# Name of the service account for the Secrets Provider.
45
name: secrets-provider-service-account
46
secretsProvider:
47
image: cgr.dev/scratch-images/test-tmp/cyberark-secrets-provider-for-k8s
48
tag: 1.11.0-r1@sha256:556cad67ae9922ba9dc3cd69a35529a7f0f733529c644ccffd623e8c3d32a1ac
49
imagePullPolicy: IfNotPresent
50
# Container name
51
name: cyberark-secrets-provider-for-k8s
52
# Optional: Name of the Job (application mode) or Deployment (standalone mode). Defaults to Helm Release.
53
workloadName:
54
# Deprecated: Use workloadName instead. Kept for backward compatibility.
55
jobName:
56
# Optional: Name of image pull secret, if Secrets Provider image is in private repository
57
imagePullSecret:
58
# OPTIONAL: Additional labels to apply to Job resource.
59
labels: {}
60
annotations: {}
61
environment:
62
# Array of Kubernetes Secret names that applications consume, and
63
# whose value is sourced in DAP/Conjur.For example, [k8s-secret1,k8s-secret2]
64
# This setting is required.
65
#
66
# k8sSecrets:
67
conjur:
68
# There are two ways that you can supply the necessary configuration to
69
# allow Secrets Provider to connect with Conjur (listed in order of
70
# precedence):
71
#
72
# 1. Using a Conjur connection ConfigMap that has been installed
73
# independently of this Helm chart, that contains the following
74
# connection parameters:
75
# CONJUR_ACCOUNT
76
# CONJUR_APPLIANCE_URL
77
# CONJUR_AUTHENTICATOR_ID
78
# CONJUR_AUTHN_URL
79
# CONJUR_SSL_CERTIFICATE
80
# To make use of an existing Conjur Connection ConfigMap, set this
81
# chart value:
82
# environment.conjur.conjurConnConfigMap
83
#
84
# 2. Providing the connection parameters directly by setting the following
85
# chart values:
86
# environment.conjur.account
87
# environment.conjur.applianceUrl
88
# environment.conjur.authnUrl
89
# environment.conjur.sslCertificate.*
90
#
91
# conjurConnConfigMap:
92
93
# DAP/Conjur account name as defined during initial DAP/Conjur configuration.
94
# This setting is required if 'conjurConnConfigMap' is not set.
95
#
96
# account:
97
98
# URL of service defined for DAP Follower/Conjur.
99
# This setting is required if 'conjurConnConfigMap' is not set.
100
#
101
# applianceUrl:
102
103
# URL for the Kubernetes authenticator with which the Secrets Provider will authenticate.
104
# This setting is required if 'conjurConnConfigMap' is not set.
105
#
106
# authnUrl:
107
sslCertificate:
108
# Name of ConfigMap that holds the public SSL certificate required for connecting to Follower/Conjur.
109
name: cert-config-map
110
# Value that stores the public SSL certificate required for connecting to Follower/Conjur.
111
# This setting is required if 'conjurConnConfigMap' is not set.
112
#
113
# value:
114
# : Host that authenticates Secrets Provider to DAP/Conjur.
115
# This setting is required.
116
#
117
# authnLogin:
118
authnJWT:
119
projectToken: false
120
projectedFilename: jwt
121
audience: conjur
122
expiration: 86400 # This is one day in seconds
123
# OPTIONAL: Set to true to install Reloader as a sub-chart for automatic
124
# application restart on secret rotation.
125
#
126
# Reloader watches Kubernetes Secrets and triggers rolling restarts of
127
# Deployments/StatefulSets when those resources change. This enables
128
# applications to automatically pick up rotated secrets without manual
129
# intervention.
130
#
131
# For more info: https://github.com/stakater/Reloader
132
autoReload:
133
enabled: false
134
# OPTIONAL: Reloader subchart configuration.
135
# Only deployed if autoReload.enabled is set to true.
136
#
137
# reloader.reloader.watchGlobally defaults to false (namespace-scoped Reloader,
138
# least privilege). When standalone.namespaceAllowlist is "*" or comma-separated
139
# (more than one namespace), set watchGlobally to true so Reloader can see secrets
140
# and workloads outside the release namespace. Schema + templates enforce this when
141
# autoReload is enabled (same allowlist shape as ClusterRole in standalone mode).
142
reloader:
143
# Reloader container image configuration
144
image:
145
repository: stakater/reloader
146
# When image.digest is set, the subchart renders repository@digest (immutable pin).
147
# After Chart.yaml bump: helm dependency update in helm/secrets-provider, then ./bin/reloader-image-digest.sh sync (CONTRIBUTING.md)
148
digest: sha256:946e6b66b08876e7fcb38d9955400bb5a00aa6906f763b99cf2a52bffbe352e3
149
pullPolicy: IfNotPresent
150
# OCI pull reference this digest was computed for (registry/repository:tag). Kubernetes may
151
# resolve short names (e.g. stakater/reloader) to docker.io; this field states the exact ref used
152
# when pinning. Update when changing mirrors, registry, or the Reloader sub-chart image tag.
153
imageDigestReference:
154
pullReference: docker.io/stakater/reloader:v1.4.15
155
# Reloader-specific configuration (maps to subchart's reloader.* values)
156
reloader:
157
# Reloader deployment configuration
158
deployment:
159
# Number of Reloader replicas. Should typically be 1 or 2 for HA.
160
# IMPORTANT: If replicas > 1, you MUST set enableHA to true.
161
# WARNING: The Reloader subchart silently caps replicas to 1 when
162
# enableHA is false, even if a higher value is specified here.
163
replicas: 1
164
# runAsUser: null removes the scalar so OpenShift's restricted-v2 SCC assigns a UID dynamically.
165
# The chart default (runAsUser: 65534) is rejected by OpenShift.
166
securityContext:
167
runAsNonRoot: true
168
runAsUser: null
169
seccompProfile:
170
type: RuntimeDefault
171
# Set to true to enable leadership election allowing you to run multiple replicas.
172
# This MUST be true if deployment.replicas > 1.
173
enableHA: false
174
# When false, Reloader only watches the release namespace (Stakater default was cluster-wide).
175
# If your allowlist is "*" or comma-separated and you enabled autoReload, you must set this to true
176
# (chart blocks install otherwise so this is not forgotten).
177
watchGlobally: false
178
# Use 'annotations' strategy: Reloader updates a reloader.stakater.com/last-reloaded-from
179
# annotation on the workload to trigger a rolling restart.
180
reloadStrategy: annotations
181
# Secrets Provider does not manage ConfigMaps, so ignore them.
182
ignoreConfigMaps: true
183
# Jobs and CronJobs are out of scope for rotation-triggered restarts.
184
ignoreJobs: true
185
ignoreCronJobs: true
186
# Alias Stakater's default annotations to Secrets Provider's annotation namespace.
187
# Use conjur.org/automatic-restart: "true" on a workload to restart on any
188
# referenced secret change (alias for secret.reloader.stakater.com/auto).
189
# Use conjur.org/restart-secrets: "my-secret" to restart only when a specific
190
# named secret changes (alias for secret.reloader.stakater.com/reload).
191
custom_annotations:
192
secret_auto: conjur.org/automatic-restart
193
# kics-scan ignore-line
194
secret: conjur.org/restart-secrets
195
# Service account configuration
196
serviceAccount:
197
create: true
198
name: reloader
199
# Resource limits and requests for Reloader
200
resources:
201
limits:
202
cpu: 100m
203
memory: 128Mi
204
requests:
205
cpu: 50m
206
memory: 64Mi
207
# RBAC configuration for Reloader
208
rbac:
209
# Whether to create RBAC resources for Reloader
210
# Set to true if your cluster has RBAC enabled (most modern clusters do)
211
create: true
212
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.