external-secrets

Renders External Secrets Operator SecretStores, ClusterSecretStores and ExternalSecrets from inventory parameters.

Latest: 1.0.4 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 20 · 1010 pulls

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/external-secrets/badge.json)](https://kadet-hub.org/generators/external-secrets/)

External Secrets Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for External Secrets Operator resources (external-secrets.io/v1):

SecretStore: namespaced provider configuration
ClusterSecretStore: cluster-scoped provider configuration
ExternalSecret: syncs provider values into a Kubernetes Secret
ClusterExternalSecret: one ExternalSecret spec fanned out across namespaces

Only ESO custom resources are rendered. ServiceAccounts, Roles and RoleBindings (for example the reader ServiceAccount a SecretStore authenticates with) belong in the kubernetes generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets@sha256:<digest>
        output_path: lib/external-secrets
    compile:
      - output_path: manifests/external-secrets/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/external-secrets

Inventory Contract

All keys live under parameters.generators.external_secrets.

Key	Scope	Description
`namespace`	generator	Default namespace for namespaced kinds. Falls back to `parameters.namespace`, then `default`.
`deny_cluster_scoped`	generator	`true` fails the compile on any ClusterSecretStore, ClusterExternalSecret, or `secretStoreRef` of kind ClusterSecretStore.
`namespace_key_prefix`	generator	Every `data[].remoteRef.key` and `dataFrom[].extract.key` of an ExternalSecret must start with `<prefix>/<namespace>/` and must not contain a `..` segment. `dataFrom[].find` and ClusterExternalSecret fail the compile because their keys cannot be checked per namespace.
`secretstores.<name>`	resource	SecretStore. `spec` is required and passed through.
`clustersecretstores.<name>`	resource	ClusterSecretStore. `spec` is required and passed through.
`externalsecrets.<name>`	resource	ExternalSecret. `spec` is passed through; shorthands below.
`clusterexternalsecrets.<name>`	resource	ClusterExternalSecret. Shorthands apply to `spec.externalSecretSpec`.

Every resource entry accepts name (overrides the map key), labels, annotations, and, for namespaced kinds, namespace.

ExternalSecret and ClusterExternalSecret shorthands:

Key	Result
`store: <name>`	`secretStoreRef: {kind: SecretStore, name: <name>}`
`cluster_store: <name>`	`secretStoreRef: {kind: ClusterSecretStore, name: <name>}`
`refresh_interval: <duration>`	`refreshInterval: <duration>`
`allow_default_refresh: true`	Allows omitting a refresh interval; ESO’s default applies.

A refresh interval is required: set refresh_interval, refreshInterval in spec, or allow_default_refresh: true on the entry. store and cluster_store are mutually exclusive. Shorthands override the same field in spec and log a warning.

Provider blocks (vault, conjur, or any other ESO provider) pass through as dicts. OpenBao uses the vault provider.

Example

parameters:
  generators:
    external_secrets:
      deny_cluster_scoped: true
      namespace_key_prefix: platform/dev
      secretstores:
        vault-backend:
          namespace: thanos
          spec:
            provider:
              vault:
                server: https://vault.example.internal
                path: secret
                version: v2
                caProvider:
                  type: ConfigMap
                  name: platform-ca
                  key: ca-bundle.crt
                auth:
                  jwt:
                    path: jwt
                    role: thanos
                    kubernetesServiceAccountToken:
                      serviceAccountRef:
                        name: external-secrets-reader
                        audiences: [vault]
        conjur-backend:
          namespace: loki
          spec:
            provider:
              conjur:
                url: https://conjur.example.internal
                auth:
                  jwt:
                    account: platform
                    serviceID: k8s-cluster-a
                    serviceAccountRef:
                      name: external-secrets-reader
      externalsecrets:
        thanos-objstore-config:
          namespace: thanos
          store: vault-backend
          refresh_interval: 1h
          spec:
            target:
              creationPolicy: Owner
              template:
                data:
                  objstore.yml: |
                    type: S3
                    config:
                      access_key: "{{ .access_key }}"
                      secret_key: "{{ .secret_key }}"
            data:
              - secretKey: access_key
                remoteRef:
                  key: platform/dev/thanos/s3
                  property: access_key
              - secretKey: secret_key
                remoteRef:
                  key: platform/dev/thanos/s3
                  property: secret_key

Output files:

Kind	Output key
SecretStore	`<namespace>/<name>-ss`
ClusterSecretStore	`<name>-css`
ExternalSecret	`<namespace>/<name>-es`
ClusterExternalSecret	`<name>-ces`

Validation failures raise ValueError: external-secrets <Kind> '<name>': <reason> and stop the compile.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.4	External Secrets Operator 2.12.0
1.0.3	External Secrets Operator 2.11.0
1.0.2	External Secrets Operator 2.11.0
1.0.1	External Secrets Operator 2.11.0
1.0.0	not recorded

1.0.4# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets:1.0.4@sha256:55395edfe463b7bf47080d55ec3245f00bc427c4dda0d6594d0a2bdb548c2954
        output_path: lib/external-secrets

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/external-secrets@sha256:55395edfe463b7bf47080d55ec3245f00bc427c4dda0d6594d0a2bdb548c2954 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274970670, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): External Secrets Operator 2.12.0
Source: external-secrets-v1.0.4 · 010b0e3f679a0a00543031e2fd7647377b9394f3 · external-secrets
Binaries: none
Output capabilities: none
Digest: sha256:55395edfe463b7bf47080d55ec3245f00bc427c4dda0d6594d0a2bdb548c2954

Checks

Checked by the release run on 2026-10-16, gate at a31e96336fac.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.3: 0 files, 0 hunks.

Output diff

1.0.3# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets:1.0.3@sha256:33e0c0426896937d24d09dcfeb27392af80f933137d1c004e512979d1c326d19
        output_path: lib/external-secrets

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/external-secrets@sha256:33e0c0426896937d24d09dcfeb27392af80f933137d1c004e512979d1c326d19 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250161756, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): External Secrets Operator 2.11.0
Source: external-secrets-v1.0.3 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · external-secrets
Binaries: none
Output capabilities: none
Digest: sha256:33e0c0426896937d24d09dcfeb27392af80f933137d1c004e512979d1c326d19

Checks

Checked by the release run on 2026-10-14, gate at a7feb61e55cd.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.2# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets:1.0.2@sha256:ebe169a6ed88497ab148e2e3e02b17cd6f97b0b6afe991443ac59f0569778573
        output_path: lib/external-secrets

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/external-secrets@sha256:ebe169a6ed88497ab148e2e3e02b17cd6f97b0b6afe991443ac59f0569778573 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244181834, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): External Secrets Operator 2.11.0
Source: external-secrets-v1.0.2 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · external-secrets
Binaries: none
Output capabilities: none
Digest: sha256:ebe169a6ed88497ab148e2e3e02b17cd6f97b0b6afe991443ac59f0569778573

Checks

Checked by the release run on 2026-10-13, gate at 529dab245f19.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets:1.0.1@sha256:963a0eb809ca980122efb6cd61e9d9bef471f7701ec8c601c8195aca326f7962
        output_path: lib/external-secrets

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/external-secrets@sha256:963a0eb809ca980122efb6cd61e9d9bef471f7701ec8c601c8195aca326f7962 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3204345902, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): External Secrets Operator 2.11.0
Source: external-secrets-v1.0.1 · 458d3e62f3c5be32fb57924e286455969e8f576b · external-secrets
Binaries: none
Output capabilities: none
Digest: sha256:963a0eb809ca980122efb6cd61e9d9bef471f7701ec8c601c8195aca326f7962

Checks

Checked by the release run on 2026-10-11, gate at 59e8d4e97d13.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/external-secrets:1.0.0@sha256:f882e0a651a269cecc7fd453c46ad823e7c59d7ac16273df88db5d01c20b7780
        output_path: lib/external-secrets

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/external-secrets@sha256:f882e0a651a269cecc7fd453c46ad823e7c59d7ac16273df88db5d01c20b7780 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3201985151, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: not recorded
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): not recorded
Source: external-secrets-v1.0.0 · a79687266b89e35a4d533473ade613056f1b4d4d · external-secrets
Binaries: none
Output capabilities: none
Digest: sha256:f882e0a651a269cecc7fd453c46ad823e7c59d7ac16273df88db5d01c20b7780

Checks

No scan record: this version was published before the release run recorded its checks. It passed the gate in its pull request.

No SBOM attestation for this version.

Output diff

No output diff recorded: this version was published before the release run recorded one.