external-secrets
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
global:
2
nodeSelector: {}
3
tolerations: []
4
topologySpreadConstraints: []
5
# - maxSkew: 1
6
# topologyKey: topology.kubernetes.io/zone
7
# whenUnsatisfiable: ScheduleAnyway
8
# matchLabelKeys:
9
# - pod-template-hash
10
# - maxSkew: 1
11
# topologyKey: kubernetes.io/hostname
12
# whenUnsatisfiable: DoNotSchedule
13
# matchLabelKeys:
14
# - pod-template-hash
15
affinity: {}
16
# -- Global hostAliases to be applied to all deployments
17
hostAliases: []
18
# -- Global pod labels to be applied to all deployments
19
podLabels: {}
20
# -- Global pod annotations to be applied to all deployments
21
podAnnotations: {}
22
# -- Global imagePullSecrets to be applied to all deployments
23
imagePullSecrets: []
24
# -- Global image repository to be applied to all deployments
25
repository: ""
26
compatibility:
27
openshift:
28
# -- Manages the securityContext properties to make them compatible with OpenShift.
29
# Possible values:
30
# auto - Apply configurations if it is detected that OpenShift is the target platform.
31
# force - Always apply configurations.
32
# disabled - No modification applied.
33
adaptSecurityContext: auto
34
replicaCount: 1
35
bitwarden-sdk-server:
36
enabled: false
37
namespaceOverride: ""
38
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
39
revisionHistoryLimit: 10
40
image:
41
repository: cgr.dev/chainguard-private/external-secrets-fips
42
pullPolicy: IfNotPresent
43
# -- The image tag to use. The default is the chart appVersion.
44
tag: latest@sha256:16d3a0d5e8cd540c76cac404d2af9ae03df1976cc2949e54d42aa25ffc11bf62
45
# -- The flavour of tag you want to use
46
# There are different image flavours available, like distroless and ubi.
47
# Please see GitHub release notes for image tags for these flavors.
48
# By default, the distroless image is used.
49
flavour: ""
50
# -- If set, install and upgrade CRDs through helm chart.
51
installCRDs: true
52
crds:
53
# -- If true, create CRDs for Cluster External Secret. If set to false you must also set processClusterExternalSecret: false.
54
createClusterExternalSecret: true
55
# -- If true, create CRDs for Cluster Secret Store. If set to false you must also set processClusterStore: false.
56
createClusterSecretStore: true
57
# -- If true, create CRDs for Secret Store. If set to false you must also set processSecretStore: false.
58
createSecretStore: true
59
# -- If true, create CRDs for Cluster Generator. If set to false you must also set processClusterGenerator: false.
60
createClusterGenerator: true
61
# -- If true, create CRDs for Cluster Push Secret. If set to false you must also set processClusterPushSecret: false.
62
createClusterPushSecret: true
63
# -- If true, create CRDs for Push Secret. If set to false you must also set processPushSecret: false.
64
createPushSecret: true
65
annotations: {}
66
conversion:
67
# -- Conversion is disabled by default as we stopped supporting v1alpha1.
68
enabled: false
69
# -- If true, enable v1beta1 API version serving for ExternalSecret, ClusterExternalSecret, SecretStore, and ClusterSecretStore CRDs.
70
# v1beta1 is deprecated. Only enable this for backward compatibility if you have existing v1beta1 resources.
71
# Warning: This flag will be removed on 2026.05.01.
72
unsafeServeV1Beta1: false
73
imagePullSecrets: []
74
nameOverride: ""
75
fullnameOverride: ""
76
namespaceOverride: ""
77
# -- Additional labels added to all helm chart resources.
78
commonLabels: {}
79
# -- If true, external-secrets will perform leader election between instances to ensure no more
80
# than one instance of external-secrets operates at a time.
81
leaderElect: false
82
# -- ID of the lease object used for leader election.
83
# Leave empty to use the default ('external-secrets-controller').
84
# Set to a unique value when running multiple independent ESO deployments in the same namespace.
85
# @default -- "external-secrets-controller"
86
leaderElectionID: ""
87
# -- Duration that non-leader candidates will wait to force acquire leadership.
88
# Increase this along with renewDeadline to tolerate a busy or briefly unavailable API server
89
# (for example during control plane maintenance) without churning leadership.
90
# Leave empty to use the controller default ('15s').
91
# @default -- "15s"
92
leaderElectionLeaseDuration: ""
93
# -- Duration that the acting leader will retry refreshing leadership before giving up.
94
# Must be less than leaderElectionLeaseDuration.
95
# Leave empty to use the controller default ('10s').
96
# @default -- "10s"
97
leaderElectionRenewDeadline: ""
98
# -- Duration the leader election client waits between tries of actions.
99
# Leave empty to use the controller default ('2s').
100
# @default -- "2s"
101
leaderElectionRetryPeriod: ""
102
# -- If set external secrets will filter matching
103
# Secret Stores with the appropriate controller values.
104
controllerClass: ""
105
# -- If true external secrets will use recommended kubernetes
106
# annotations as prometheus metric labels.
107
extendedMetricLabels: false
108
# -- If set external secrets are only reconciled in the
109
# provided namespace
110
scopedNamespace: ""
111
# -- If true, create scoped RBAC roles and implicitly disable cluster-scoped
112
# controllers. Scoped to scopedNamespace if set, otherwise to .Release.Namespace.
113
scopedRBAC: false
114
# -- If true the OpenShift finalizer permissions will be added to RBAC
115
openshiftFinalizers: true
116
# -- If true the system:auth-delegator ClusterRole will be added to RBAC
117
systemAuthDelegator: false
118
# -- if true, the operator will process cluster external secret. Else, it will ignore them.
119
# When enabled, this adds update/patch permissions on namespaces to handle finalizers for proper
120
# cleanup during namespace deletion, preventing race conditions with ExternalSecrets.
121
processClusterExternalSecret: true
122
# -- if true, the operator will process cluster push secret. Else, it will ignore them.
123
processClusterPushSecret: true
124
# -- if true, the operator will process cluster store. Else, it will ignore them.
125
processClusterStore: true
126
# -- if true, the operator will process secret store. Else, it will ignore them.
127
processSecretStore: true
128
# -- Default time duration between reconciling (Cluster)SecretStores.
129
storeRequeueInterval: ""
130
# -- if true, the operator will process cluster generator. Else, it will ignore them.
131
processClusterGenerator: true
132
# -- if true, the operator will process push secret. Else, it will ignore them.
133
processPushSecret: true
134
# -- Enable support for generic targets (ConfigMaps, Custom Resources).
135
# Warning: Using generic target. Make sure access policies and encryption are properly configured.
136
# When enabled, this grants the controller permissions to create/update/delete
137
# ConfigMaps and optionally other resource types specified in generic.resources.
138
genericTargets:
139
# -- Enable generic target support
140
enabled: false
141
# -- List of additional resource types to grant permissions for.
142
# Each entry should specify apiGroup, resources, and verbs.
143
# Example:
144
# resources:
145
# - apiGroup: "argoproj.io"
146
# resources: ["applications"]
147
# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
148
resources: []
149
# -- Specifies whether an external secret operator deployment be created.
150
createOperator: true
151
# -- if true, HTTP2 will be enabled for the services created by all controllers, curently metrics and webhook.
152
enableHTTP2: false
153
# -- Vault token cache configuration
154
vault:
155
# -- Enable Vault token cache. External secrets will reuse the Vault token without creating a new one on each request.
156
enableTokenCache: false
157
# -- Maximum size of Vault token cache. Only used if enableTokenCache is true.
158
tokenCacheSize: 262144
159
# -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at
160
# a time.
161
concurrent: 1
162
# -- Specifies Log Params to the External Secrets Operator
163
log:
164
level: info
165
timeEncoding: epoch
166
service:
167
# -- Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
168
ipFamilyPolicy: ""
169
# -- Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
170
ipFamilies: []
171
serviceAccount:
172
# -- Specifies whether a service account should be created.
173
create: true
174
# -- Automounts the service account token in all containers of the pod
175
automount: true
176
# -- Annotations to add to the service account.
177
annotations: {}
178
# -- Extra Labels to add to the service account.
179
extraLabels: {}
180
# -- The name of the service account to use.
181
# If not set and create is true, a name is generated using the fullname template.
182
name: ""
183
rbac:
184
# -- Specifies whether role and rolebinding resources should be created.
185
create: true
186
# -- Specifies whether the serviceaccounts/token create permission is included in the controller RBAC.
187
# When set to false, users must create per-ServiceAccount Role/RoleBinding with resourceNames constraint
188
# to grant ESO token creation for specific ServiceAccounts referenced in SecretStore specs.
189
serviceAccountTokenCreate: true
190
servicebindings:
191
# -- Specifies whether a clusterrole to give servicebindings read access should be created.
192
create: true
193
# -- Specifies whether permissions are aggregated to the view ClusterRole
194
aggregateToView: true
195
# -- Specifies whether permissions are aggregated to the edit ClusterRole
196
aggregateToEdit: true
197
# -- Specifies whether permissions are aggregated to the admin ClusterRole
198
aggregateToAdmin: true
199
## -- Extra environment variables to add to container.
200
extraEnv: []
201
## -- Map of extra arguments to pass to container.
202
extraArgs: {}
203
## -- Extra volumes to pass to pod.
204
extraVolumes: []
205
## -- Extra Kubernetes objects to deploy with the helm chart
206
extraObjects: []
207
## -- Extra volumes to mount to the container.
208
extraVolumeMounts: []
209
## -- Extra init containers to add to the pod.
210
extraInitContainers: []
211
## -- Extra containers to add to the pod.
212
extraContainers: []
213
# -- Annotations to add to Deployment
214
deploymentAnnotations: {}
215
# -- Set deployment strategy
216
strategy: {}
217
# -- Annotations to add to Pod
218
podAnnotations: {}
219
podLabels: {}
220
podSecurityContext:
221
enabled: true
222
# fsGroup: 2000
223
securityContext:
224
allowPrivilegeEscalation: false
225
capabilities:
226
drop:
227
- ALL
228
enabled: true
229
readOnlyRootFilesystem: true
230
runAsNonRoot: true
231
runAsUser: 1000
232
seccompProfile:
233
type: RuntimeDefault
234
resources: {}
235
# requests:
236
# cpu: 10m
237
# memory: 32Mi
238
239
serviceMonitor:
240
# -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
241
enabled: false
242
# -- How should we react to missing CRD "`monitoring.coreos.com/v1/ServiceMonitor`"
243
#
244
# Possible values:
245
# - `skipIfMissing`: Only render ServiceMonitor resources if CRD is present, skip if missing.
246
# - `failIfMissing`: Fail Helm install if CRD is not present.
247
# - `alwaysRender` : Always render ServiceMonitor resources, do not check for CRD.
248
249
# @schema
250
# enum:
251
# - skipIfMissing
252
# - failIfMissing
253
# - alwaysRender
254
# @schema
255
renderMode: skipIfMissing # @schema enum: [skipIfMissing, failIfMissing, alwaysRender]
256
# -- namespace where you want to install ServiceMonitors
257
namespace: ""
258
# -- Additional labels
259
additionalLabels: {}
260
# -- Interval to scrape metrics
261
interval: 30s
262
# -- Timeout if metrics can't be retrieved in given time interval
263
scrapeTimeout: 25s
264
# -- Let prometheus add an exported_ prefix to conflicting labels
265
honorLabels: false
266
# -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)
267
metricRelabelings: []
268
# - action: replace
269
# regex: (.*)
270
# replacement: $1
271
# sourceLabels:
272
# - exported_namespace
273
# targetLabel: namespace
274
275
# -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)
276
relabelings: []
277
# - sourceLabels: [__meta_kubernetes_pod_node_name]
278
# separator: ;
279
# regex: ^(.*)$
280
# targetLabel: nodename
281
# replacement: $1
282
# action: replace
283
metrics:
284
listen:
285
port: 8080
286
auth:
287
# -- Enable Kubernetes RBAC-based authentication for metrics endpoint. Requires metrics.listen.secure to be true. Default value is false.
288
enabled: false
289
secure:
290
enabled: false
291
# -- if those are not set or invalid, self-signed certs will be generated
292
# -- TLS cert directory path
293
certDir: /etc/tls
294
# -- TLS cert file path
295
certFile: /etc/tls/tls.crt
296
# -- TLS key file path
297
keyFile: /etc/tls/tls.key
298
service:
299
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
300
enabled: false
301
# -- Metrics service port to scrape
302
port: 8080
303
# -- Additional service annotations
304
annotations: {}
305
grafanaDashboard:
306
# -- If true creates a Grafana dashboard.
307
enabled: false
308
# -- Label that ConfigMaps should have to be loaded as dashboards.
309
sidecarLabel: "grafana_dashboard"
310
# -- Label value that ConfigMaps should have to be loaded as dashboards.
311
sidecarLabelValue: "1"
312
# -- Annotations that ConfigMaps can have to get configured in Grafana,
313
# See: sidecar.dashboards.folderAnnotation for specifying the dashboard folder.
314
# https://github.com/grafana/helm-charts/tree/main/charts/grafana
315
annotations: {}
316
# -- Extra labels to add to the Grafana dashboard ConfigMap.
317
extraLabels: {}
318
livenessProbe:
319
# -- Enabled determines if the liveness probe should be used or not. By default it's disabled.
320
enabled: false
321
# -- The body of the liveness probe settings.
322
spec:
323
# -- Bind address for the health server used by both liveness and readiness probes (--live-addr flag).
324
address: ""
325
# -- Port for the health server used by both liveness and readiness probes (--live-addr flag).
326
port: 8082
327
# -- Specify the maximum amount of time to wait for a probe to respond before considering it fails.
328
timeoutSeconds: 5
329
# -- Number of consecutive probe failures that should occur before considering the probe as failed.
330
failureThreshold: 5
331
# -- Period in seconds for K8s to start performing probes.
332
periodSeconds: 10
333
# -- Number of successful probes to mark probe successful.
334
successThreshold: 1
335
# -- Delay in seconds for the container to start before performing the initial probe.
336
initialDelaySeconds: 10
337
# -- Handler for liveness probe.
338
httpGet:
339
# -- Set this value to 'live' (for named port) or an an integer for liveness probes.
340
# @schema type: [string, integer]
341
port: live
342
# -- Path for liveness probe.
343
path: /healthz
344
readinessProbe:
345
# -- Determines whether the readiness probe is enabled. Disabled by default. Enabling this will auto-start the health server (--live-addr) even if livenessProbe is disabled. Health server address/port are configured via livenessProbe.spec.address and livenessProbe.spec.port.
346
enabled: false
347
# -- The body of the readiness probe settings (standard Kubernetes probe spec).
348
spec:
349
# -- Specify the maximum amount of time to wait for a probe to respond before considering it fails.
350
timeoutSeconds: 5
351
# -- Number of consecutive probe failures that should occur before considering the probe as failed.
352
failureThreshold: 3
353
# -- Period in seconds for K8s to start performing probes.
354
periodSeconds: 10
355
# -- Number of successful probes to mark probe successful.
356
successThreshold: 1
357
# -- Delay in seconds for the container to start before performing the initial probe.
358
initialDelaySeconds: 10
359
# -- Handler for readiness probe.
360
httpGet:
361
# -- Set this value to 'live' (for named port) or an integer for readiness probes.
362
# @schema type: [string, integer]
363
port: live
364
# -- Path for readiness probe.
365
path: /readyz
366
nodeSelector: {}
367
tolerations: []
368
topologySpreadConstraints: []
369
affinity: {}
370
# -- Pod priority class name.
371
priorityClassName: ""
372
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
373
podDisruptionBudget:
374
enabled: false
375
minAvailable: 1 # @schema type:[integer, string]
376
nameOverride: ""
377
# maxUnavailable: "50%"
378
# -- Run the controller on the host network
379
hostNetwork: false
380
# -- (bool) Specifies if controller pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
381
# @schema type: [boolean, null]
382
hostUsers:
383
# -- Setup a networkPolicy for external-secrets
384
networkPolicy:
385
# -- Specifies whether the networkPolicy should be created.
386
enabled: false
387
# -- The ingress traffic
388
# Should match the health and (optionally) metrics port
389
ingress:
390
- ports:
391
- protocol: TCP
392
# @schema type: [string, integer]
393
port: 8080 # metrics port
394
- protocol: TCP
395
# @schema type: [string, integer]
396
port: 8082 # health port
397
# -- The egress traffic
398
# The minimum egress ports required to function are:
399
# DNS (53/udp, 53/tcp)
400
# API server (80/tcp, 443/tcp, or 6443/tcp)
401
# You will need to customize this value to meet your needs
402
egress: []
403
webhook:
404
# -- Annotations to place on validating webhook configuration.
405
annotations: {}
406
# -- Specifies whether a webhook deployment be created. If set to false, crds.conversion.enabled should also be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint.
407
create: true
408
# -- Specifies the time to check if the cert is valid
409
certCheckInterval: "5m"
410
# -- Specifies the lookaheadInterval for certificate validity
411
lookaheadInterval: ""
412
replicaCount: 1
413
# -- Specifies Log Params to the Webhook
414
log:
415
level: info
416
timeEncoding: epoch
417
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
418
revisionHistoryLimit: 10
419
certDir: /tmp/certs
420
# -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
421
failurePolicy: Fail
422
# -- Specifies if webhook pod should use hostNetwork or not.
423
hostNetwork: false
424
# -- (bool) Specifies if webhook pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
425
# @schema type: [boolean, null]
426
hostUsers:
427
# -- Setup a networkPolicy for external-secrets webhook
428
networkPolicy:
429
# -- Specifies whether the networkPolicy should be created.
430
enabled: false
431
# -- The ingress traffic
432
# Should match the webhook, health, and (optionally) metrics port
433
ingress:
434
- ports:
435
- protocol: TCP
436
# @schema type: [string, integer]
437
port: 8080 # metrics port
438
- protocol: TCP
439
# @schema type: [string, integer]
440
port: 8081 # health port
441
- protocol: TCP
442
# @schema type: [string, integer]
443
port: 10250 # webhook port
444
# -- The egress traffic
445
# The minimum egress ports required to function are:
446
# DNS (53/udp, 53/tcp)
447
# API server (80/tcp, 443/tcp, or 6443/tcp)
448
# You will need to customize this value to meet your needs
449
egress: []
450
image:
451
repository: cgr.dev/chainguard-private/external-secrets-fips
452
pullPolicy: IfNotPresent
453
# -- The image tag to use. The default is the chart appVersion.
454
tag: latest@sha256:16d3a0d5e8cd540c76cac404d2af9ae03df1976cc2949e54d42aa25ffc11bf62
455
# -- The flavour of tag you want to use
456
flavour: ""
457
imagePullSecrets: []
458
# -- The port the webhook will listen to
459
port: 10250
460
serviceAccount:
461
# -- Specifies whether a service account should be created.
462
create: true
463
# -- Automounts the service account token in all containers of the pod
464
automount: true
465
# -- Annotations to add to the service account.
466
annotations: {}
467
# -- Extra Labels to add to the service account.
468
extraLabels: {}
469
# -- The name of the service account to use.
470
# If not set and create is true, a name is generated using the fullname template.
471
name: ""
472
nodeSelector: {}
473
# -- Specifies `hostAliases` to webhook deployment
474
hostAliases: []
475
certManager:
476
# -- Enabling cert-manager support will disable the built in secret and
477
# switch to using cert-manager (installed separately) to automatically issue
478
# and renew the webhook certificate. This chart does not install
479
# cert-manager for you, See https://cert-manager.io/docs/
480
enabled: false
481
# -- Automatically add the cert-manager.io/inject-ca-from annotation to the
482
# webhooks and CRDs. As long as you have the cert-manager CA Injector
483
# enabled, this will automatically setup your webhook's CA to the one used
484
# by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector
485
addInjectorAnnotations: true
486
cert:
487
# -- Create a certificate resource within this chart. See
488
# https://cert-manager.io/docs/usage/certificate/
489
create: true
490
# -- For the Certificate created by this chart, setup the issuer. See
491
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec
492
issuerRef:
493
group: cert-manager.io
494
kind: "Issuer"
495
name: "my-issuer"
496
# -- Set the requested duration (i.e. lifetime) of the Certificate. See
497
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
498
# One year by default.
499
duration: "8760h0m0s"
500
# -- Set the revisionHistoryLimit on the Certificate. See
501
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
502
# Defaults to 0 (ignored).
503
revisionHistoryLimit: 0
504
# -- How long before the currently issued certificate’s expiry
505
# cert-manager should renew the certificate. See
506
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
507
# Note that renewBefore should be greater than .webhook.lookaheadInterval
508
# since the webhook will check this far in advance that the certificate is
509
# valid.
510
renewBefore: ""
511
# -- Specific settings on the privateKey and its generation
512
privateKey: {}
513
# rotationPolicy: Always
514
# algorithm: RSA
515
# size: 2048
516
# -- Specific settings on the signatureAlgorithm used on the cert.
517
# signatureAlgorithm is only valid for cert-manager v1.18.0+
518
signatureAlgorithm: ""
519
# -- Add extra annotations to the Certificate resource.
520
annotations: {}
521
tolerations: []
522
topologySpreadConstraints: []
523
affinity: {}
524
# -- Set deployment strategy
525
strategy: {}
526
# -- Pod priority class name.
527
priorityClassName: ""
528
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
529
podDisruptionBudget:
530
enabled: false
531
minAvailable: 1 # @schema type:[integer, string]
532
nameOverride: ""
533
# maxUnavailable: "50%"
534
metrics:
535
listen:
536
port: 8080
537
auth:
538
# -- Enable Kubernetes RBAC-based authentication for webhook's metrics endpoint. Requires webhook.metrics.listen.secure to be true. Default value is false.
539
enabled: false
540
secure:
541
enabled: false
542
# -- if those are not set or invalid, self-signed certs will be generated
543
# -- TLS cert directory path
544
certDir: /etc/tls
545
# -- TLS cert file path
546
certFile: /etc/tls/tls.crt
547
# -- TLS key file path
548
keyFile: /etc/tls/tls.key
549
service:
550
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
551
enabled: false
552
# -- Metrics service port to scrape
553
port: 8080
554
# -- Additional service annotations
555
annotations: {}
556
livenessProbe:
557
enabled: false
558
# -- Set this value to 'live' (for named port) or an integer for liveness probes.
559
# @schema type: [string, integer]
560
port: 8081
561
timeoutSeconds: 5
562
failureThreshold: 5
563
periodSeconds: 10
564
successThreshold: 1
565
initialDelaySeconds: 10
566
readinessProbe:
567
enabled: true
568
address: ""
569
# -- Set this value to 'ready' (for named port) or an integer for readiness probes.
570
# @schema type: [string, integer]
571
port: 8081
572
timeoutSeconds: 5
573
failureThreshold: 3
574
periodSeconds: 5
575
successThreshold: 1
576
initialDelaySeconds: 20
577
startupProbe:
578
# -- Enabled determines if the startup probe should be used or not. By default it's disabled.
579
enabled: false
580
# -- Number of seconds after the container has started before the startup probe is initiated.
581
initialDelaySeconds: 10
582
# -- How often (in seconds) to perform the startup probe.
583
periodSeconds: 10
584
# -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds.
585
failureThreshold: 30
586
## -- Extra environment variables to add to container.
587
extraEnv: []
588
## -- Map of extra arguments to pass to container.
589
extraArgs: {}
590
## -- Extra init containers to add to the pod.
591
extraInitContainers: []
592
## -- Extra volumes to pass to pod.
593
extraVolumes: []
594
## -- Extra volumes to mount to the container.
595
extraVolumeMounts: []
596
# -- Annotations to add to Secret
597
secretAnnotations: {}
598
# -- Annotations to add to Deployment
599
deploymentAnnotations: {}
600
# -- Annotations to add to Pod
601
podAnnotations: {}
602
podLabels: {}
603
podSecurityContext:
604
enabled: true
605
# fsGroup: 2000
606
securityContext:
607
allowPrivilegeEscalation: false
608
capabilities:
609
drop:
610
- ALL
611
enabled: true
612
readOnlyRootFilesystem: true
613
runAsNonRoot: true
614
runAsUser: 1000
615
seccompProfile:
616
type: RuntimeDefault
617
resources: {}
618
# requests:
619
# cpu: 10m
620
# memory: 32Mi
621
622
# -- Manage the service through which the webhook is reached.
623
service:
624
# -- Whether the service object should be enabled or not (it is expected to exist).
625
enabled: true
626
# -- Custom annotations for the webhook service.
627
annotations: {}
628
# -- Custom labels for the webhook service.
629
labels: {}
630
# -- The service type of the webhook service.
631
type: ClusterIP
632
# -- If the webhook service type is LoadBalancer, you can assign a specific load balancer IP here.
633
# Check the documentation of your load balancer provider to see if/how this should be used.
634
loadBalancerIP: ""
635
certController:
636
# -- Specifies whether a certificate controller deployment be created.
637
create: true
638
requeueInterval: "5m"
639
replicaCount: 1
640
# -- Specifies Log Params to the Certificate Controller
641
log:
642
level: info
643
timeEncoding: epoch
644
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
645
revisionHistoryLimit: 10
646
image:
647
repository: cgr.dev/chainguard-private/external-secrets-fips
648
pullPolicy: IfNotPresent
649
tag: latest@sha256:16d3a0d5e8cd540c76cac404d2af9ae03df1976cc2949e54d42aa25ffc11bf62
650
flavour: ""
651
imagePullSecrets: []
652
rbac:
653
# -- Specifies whether role and rolebinding resources should be created.
654
create: true
655
serviceAccount:
656
# -- Specifies whether a service account should be created.
657
create: true
658
# -- Automounts the service account token in all containers of the pod
659
automount: true
660
# -- Annotations to add to the service account.
661
annotations: {}
662
# -- Extra Labels to add to the service account.
663
extraLabels: {}
664
# -- The name of the service account to use.
665
# If not set and create is true, a name is generated using the fullname template.
666
name: ""
667
nodeSelector: {}
668
# -- Specifies `hostAliases` to cert-controller deployment
669
hostAliases: []
670
tolerations: []
671
topologySpreadConstraints: []
672
affinity: {}
673
# -- Set deployment strategy
674
strategy: {}
675
# -- Run the certController on the host network
676
hostNetwork: false
677
# -- (bool) Specifies if certController pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
678
# @schema type: [boolean, null]
679
hostUsers:
680
# -- Setup a networkPolicy for external-secrets certController
681
networkPolicy:
682
# -- Specifies whether the networkPolicy should be created.
683
enabled: false
684
# -- The ingress traffic
685
# Should match the health and (optionally) metrics port
686
ingress:
687
- ports:
688
- protocol: TCP
689
# @schema type: [string, integer]
690
port: 8080 # metrics port
691
- protocol: TCP
692
# @schema type: [string, integer]
693
port: 8081 # health port
694
# -- The egress traffic
695
# The minimum egress ports required to function are:
696
# DNS (53/udp, 53/tcp)
697
# API server (80/tcp, 443/tcp, or 6443/tcp)
698
# You will need to customize this value to meet your needs
699
egress: []
700
# -- Pod priority class name.
701
priorityClassName: ""
702
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
703
podDisruptionBudget:
704
enabled: false
705
minAvailable: 1 # @schema type:[integer, string]
706
nameOverride: ""
707
# maxUnavailable: "50%"
708
metrics:
709
listen:
710
port: 8080
711
auth:
712
# -- Enable Kubernetes RBAC-based authentication for certController's metrics endpoint. Requires certController.metrics.listen.secure to be true. Default value is false.
713
enabled: false
714
secure:
715
enabled: false
716
# -- if those are not set or invalid, self-signed certs will be generated
717
# -- TLS cert directory path
718
certDir: /etc/tls
719
# -- TLS cert file path
720
certFile: /etc/tls/tls.crt
721
# -- TLS key file path
722
keyFile: /etc/tls/tls.key
723
service:
724
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
725
enabled: false
726
# -- Metrics service port to scrape
727
port: 8080
728
# -- Additional service annotations
729
annotations: {}
730
livenessProbe:
731
enabled: false
732
# -- Set this value to 'live' (for named port) or an integer for liveness probes.
733
# @schema type: [string, integer]
734
port: 8081
735
timeoutSeconds: 5
736
failureThreshold: 5
737
periodSeconds: 10
738
successThreshold: 1
739
initialDelaySeconds: 10
740
readinessProbe:
741
enabled: true
742
address: ""
743
# -- Set this value to 'ready' (for named port) or an integer for readiness probes.
744
# @schema type: [string, integer]
745
port: 8081
746
timeoutSeconds: 5
747
failureThreshold: 3
748
periodSeconds: 5
749
successThreshold: 1
750
initialDelaySeconds: 20
751
startupProbe:
752
# -- Enabled determines if the startup probe should be used or not. By default it's disabled.
753
enabled: false
754
# -- Number of seconds after the container has started before the startup probe is initiated.
755
initialDelaySeconds: 10
756
# -- How often (in seconds) to perform the startup probe.
757
periodSeconds: 10
758
# -- Number of consecutive failures before the container is restarted. The startup window is initialDelaySeconds + failureThreshold * periodSeconds.
759
failureThreshold: 30
760
## -- Extra environment variables to add to container.
761
extraEnv: []
762
## -- Map of extra arguments to pass to container.
763
extraArgs: {}
764
## -- Extra init containers to add to the pod.
765
extraInitContainers: []
766
## -- Extra volumes to pass to pod.
767
extraVolumes: []
768
## -- Extra volumes to mount to the container.
769
extraVolumeMounts: []
770
# -- Annotations to add to Deployment
771
deploymentAnnotations: {}
772
# -- Annotations to add to Pod
773
podAnnotations: {}
774
podLabels: {}
775
podSecurityContext:
776
enabled: true
777
# fsGroup: 2000
778
securityContext:
779
allowPrivilegeEscalation: false
780
capabilities:
781
drop:
782
- ALL
783
enabled: true
784
readOnlyRootFilesystem: true
785
runAsNonRoot: true
786
runAsUser: 1000
787
seccompProfile:
788
type: RuntimeDefault
789
resources: {}
790
# requests:
791
# cpu: 10m
792
# memory: 32Mi
793
# -- Specifies `dnsPolicy` to deployment
794
dnsPolicy: ClusterFirst
795
# -- Specifies `dnsOptions` to deployment
796
dnsConfig: {}
797
# -- Specifies `hostAliases` to deployment
798
hostAliases: []
799
# -- Any extra pod spec on the deployment
800
podSpecExtra: {}
801
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.