external-secrets helm

External Secrets is a Kubernetes operator that synchronizes secrets from external secret management systems (e.g., AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, 1Password) into Kubernetes secrets. It ensures that sensitive data stays outside the cluster while being securely referenced within applications. External Secrets supports automatic synchronization, templating, and multi-backend integration, making it a scalable and secure solution for managing secrets in Kubernetes environments.

Install

Install with:

helm repo add external-secrets https://charts.external-secrets.io/
helm install external-secrets external-secrets/external-secrets -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 96)

NameRepoStarsVersionTimestamp
external-secretsqjoly/GitOps450.15.02 days ago
external-secretscoolguy1771/home-ops700.15.04 days ago
external-secretscoolguy1771/home-ops700.15.04 days ago
external-secretsqjoly/GitOps450.15.05 days ago
external-secretsqjoly/GitOps450.15.05 days ago

Values

See the most popular values for this chart:

KeyTypes
installCRDs (80)
true
boolean
serviceMonitor.enabled (75)
true
boolean
serviceMonitor.interval (67)
1m
string
certController.serviceMonitor.enabled (64)
true
boolean
certController.serviceMonitor.interval (60)
1m
string
certController.image.repository (22)
ghcr.io/external-secrets/external-secrets
string
certController.resources.requests.cpu (4)
10m
string
certController.resources.requests.memory (3)
string
certController.resources.limits.memory (3)
string
certController.resources.limits.cpu (2)
string
certController.create (1)
boolean
certController.extraVolumeMounts[].mountPath (1)
string
certController.extraVolumeMounts[].name (1)
string
certController.extraVolumeMounts[].readOnly (1)
boolean
certController.extraVolumes[].name (1)
string
certController.extraVolumes[].projected.defaultMode (1)
number
certController.extraVolumes[].projected.sources[].configMap.items[].key (1)
string
certController.extraVolumes[].projected.sources[].configMap.items[].path (1)
string
certController.extraVolumes[].projected.sources[].configMap.name (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
certController.extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
certController.extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
certController.log.level (1)
string
certController.log.timeEncoding (1)
string
certController.podDisruptionBudget.enabled (1)
boolean
certController.podDisruptionBudget.minAvailable (1)
number
certController.podLabels."egress.home.arpa/apiserver" (1)
string
certController.podLabels."prom.home.arpa/kps" (1)
string
certController.replicaCount (1)
number
certController.requeueInterval (1)
string
certController.revisionHistoryLimit (1)
number
certController.serviceAccount.automount (1)
boolean
certController.serviceAccount.create (1)
boolean
webhook.serviceMonitor.enabled (63)
true
boolean
webhook.serviceMonitor.interval (59)
1m
string
webhook.image.repository (22)
ghcr.io/external-secrets/external-secrets
string
webhook.resources.requests.cpu (4)
10m
string
webhook.resources.requests.memory (3)
string
webhook.resources.limits.memory (3)
string
webhook.resources.limits.cpu (2)
string
webhook.certManager.enabled (3)
boolean
webhook.certManager.cert.issuerRef.kind (2)
string
webhook.certManager.cert.issuerRef.name (2)
string
webhook.certManager.cert.issuerRef.group (1)
string
webhook.certManager.cert.create (1)
boolean
webhook.certManager.cert.duration (1)
string
webhook.certManager.cert.renewBefore (1)
string
webhook.certManager.addInjectorAnnotations (1)
boolean
webhook.certManager.log.level (1)
string
webhook.replicaCount (2)
number
webhook.certCheckInterval (1)
string
webhook.create (1)
boolean
webhook.extraVolumeMounts[].mountPath (1)
string
webhook.extraVolumeMounts[].name (1)
string
webhook.extraVolumeMounts[].readOnly (1)
boolean
webhook.extraVolumes[].name (1)
string
webhook.extraVolumes[].projected.defaultMode (1)
number
webhook.extraVolumes[].projected.sources[].configMap.items[].key (1)
string
webhook.extraVolumes[].projected.sources[].configMap.items[].path (1)
string
webhook.extraVolumes[].projected.sources[].configMap.name (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
webhook.extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
webhook.extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
webhook.log.level (1)
string
webhook.log.timeEncoding (1)
string
webhook.lookaheadInterval (1)
string
webhook.podDisruptionBudget.enabled (1)
boolean
webhook.podDisruptionBudget.minAvailable (1)
number
webhook.podLabels."ingress.home.arpa/apiserver" (1)
string
webhook.podLabels."prom.home.arpa/kps" (1)
string
webhook.revisionHistoryLimit (1)
number
webhook.serviceAccount.automount (1)
boolean
webhook.serviceAccount.create (1)
boolean
replicaCount (38)
1
number
image.repository (23)
ghcr.io/external-secrets/external-secrets
string
image.tag (1)
string
leaderElect (21)
true
boolean
grafana.enabled (11)
true
boolean
reportsController.serviceMonitor.enabled (10)
true
boolean
reportsController.serviceMonitor.interval (10)
1m
string
backgroundController.serviceMonitor.enabled (9)
true
boolean
backgroundController.serviceMonitor.interval (9)
1m
string
cleanupController.serviceMonitor.enabled (9)
true
boolean
cleanupController.serviceMonitor.interval (9)
1m
string
bitwarden-sdk-server.enabled (7)
true
boolean
bitwarden-sdk-server.podAnnotations."secret.reloader.stakater.com/reload" (4)
string
bitwarden-sdk-server.serviceMonitor.enabled (2)
boolean
bitwarden-sdk-server.serviceMonitor.interval (2)
string
resources.requests.cpu (4)
string
resources.requests.memory (3)
string
resources.limits.memory (3)
string
resources.limits.cpu (2)
string
resources.cpu (1)
string
resources.memory (1)
string
global.tolerations[].effect (3)
NoSchedule
string
global.tolerations[].key (3)
node-role.kubernetes.io/control-plane
string
global.tolerations[].operator (1)
string
global.nodeSelector."node-role.kubernetes.io/control-plane" (2)
string
global.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)
string
global.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)
string
global.topologySpreadConstraints[].labelSelector.matchLabels.app (1)
string
global.topologySpreadConstraints[].maxSkew (1)
number
global.topologySpreadConstraints[].topologyKey (1)
string
global.topologySpreadConstraints[].whenUnsatisfiable (1)
string
extraArgs.loglevel (2)
string
extraVolumes[].name (2)
string
extraVolumes[].projected.defaultMode (1)
number
extraVolumes[].projected.sources[].configMap.items[].key (1)
string
extraVolumes[].projected.sources[].configMap.items[].path (1)
string
extraVolumes[].projected.sources[].configMap.name (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
extraVolumes[].secret.defaultMode (1)
number
extraVolumes[].secret.secretName (1)
string
log.level (2)
string
log.timeEncoding (1)
string
concurrent (1)
number
controllerClass (1)
string
crds.createClusterExternalSecret (1)
boolean
crds.createClusterSecretStore (1)
boolean
extendedMetricLabels (1)
boolean
extraContainers[].env[].name (1)
string
extraContainers[].env[].value (1)
string
extraContainers[].image (1)
string
extraContainers[].imagePullPolicy (1)
string
extraContainers[].name (1)
string
extraContainers[].resources.limits.cpu (1)
string
extraContainers[].resources.limits.ephemeral-storage (1)
string
extraContainers[].resources.limits.memory (1)
string
extraContainers[].resources.requests.cpu (1)
string
extraContainers[].securityContext.allowPrivilegeEscalation (1)
boolean
extraContainers[].securityContext.capabilities.drop[] (1)
string
extraContainers[].securityContext.readOnlyRootFilesystem (1)
boolean
extraContainers[].securityContext.runAsNonRoot (1)
boolean
extraContainers[].securityContext.runAsUser (1)
number
extraContainers[].securityContext.seccompProfile.type (1)
string
extraContainers[].volumeMounts[].mountPath (1)
string
extraContainers[].volumeMounts[].name (1)
string
extraContainers[].volumeMounts[].readOnly (1)
boolean
extraEnv[].name (1)
string
extraEnv[].value (1)
string
extraVolumeMounts[].mountPath (1)
string
extraVolumeMounts[].name (1)
string
extraVolumeMounts[].readOnly (1)
boolean
installCRDS (1)
boolean
podDisruptionBudget.enabled (1)
boolean
podDisruptionBudget.minAvailable (1)
number
podLabels."egress.home.arpa/apiserver" (1)
string
podLabels."egress.home.arpa/onepassword-connect" (1)
string
podLabels."prom.home.arpa/kps" (1)
string
podSecurityContext.fsGroup (1)
number
podSecurityContext.fsGroupChangePolicy (1)
string
processClusterExternalSecret (1)
boolean
processClusterStore (1)
boolean
rbac.create (1)
boolean
rbac.servicebindings.create (1)
boolean
revisionHistoryLimit (1)
number
serviceAccount.automount (1)
boolean
serviceAccount.create (1)
boolean
topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (1)
string
topologySpreadConstraints[].maxSkew (1)
number
topologySpreadConstraints[].topologyKey (1)
string
topologySpreadConstraints[].whenUnsatisfiable (1)
string