external-secrets helm

External Secrets is a Kubernetes operator that synchronizes secrets from external secret management systems (e.g., AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, 1Password) into Kubernetes secrets. It ensures that sensitive data stays outside the cluster while being securely referenced within applications. External Secrets supports automatic synchronization, templating, and multi-backend integration, making it a scalable and secure solution for managing secrets in Kubernetes environments.

Install

Install with:

helm repo add external-secrets oci://ghcr.io/external-secrets/charts/external-secrets
helm install external-secrets external-secrets/external-secrets -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 100)

NameRepoStarsVersionTimestamp
external-secretskashalls/home-cluster1051.2.113 days ago
external-secretswaifulabs/infrastructure1961.2.113 days ago
external-secretsjfroy/flatops331.2.114 days ago
external-secretsnicolerenee/infra1001.2.115 days ago
external-secretsauricom/home-ops2021.2.116 days ago

Resources

32Mi128Mi
128Mi256Mi512Mi
10m15m50m100m

Values

See the most popular values for this chart:

KeyTypes
serviceMonitor.enabled (72)
true
boolean
serviceMonitor.interval (34)
1m
string
serviceMonitor.metricRelabelings[].action (1)
string
serviceMonitor.metricRelabelings[].regex (1)
string
serviceMonitor.metricRelabelings[].sourceLabels[] (1)
string
grafanaDashboard.enabled (59)
true
boolean
grafanaDashboard.annotations.grafana_folder (4)
string
leaderElect (55)
true
boolean
certController.serviceMonitor.enabled (45)
true
boolean
certController.serviceMonitor.interval (29)
1m
string
certController.image.repository (33)
ghcr.io/external-secrets/external-secrets
string
certController.resources.requests.cpu (5)
string
certController.resources.requests.memory (5)
string
certController.resources.limits.memory (3)
string
certController.podLabels."egress.cilium.io/kube-apiserver" (2)
string
certController.enabled (1)
boolean
certController.extraVolumeMounts[].mountPath (1)
string
certController.extraVolumeMounts[].name (1)
string
certController.extraVolumeMounts[].readOnly (1)
boolean
certController.extraVolumes[].name (1)
string
certController.extraVolumes[].projected.defaultMode (1)
number
certController.extraVolumes[].projected.sources[].configMap.items[].key (1)
string
certController.extraVolumes[].projected.sources[].configMap.items[].path (1)
string
certController.extraVolumes[].projected.sources[].configMap.name (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
certController.extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
certController.extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
certController.extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
certController.podDisruptionBudget.enabled (1)
boolean
certController.podDisruptionBudget.minAvailable (1)
number
certController.priorityClassName (1)
string
certController.serviceAccount.automount (1)
boolean
certController.serviceAccount.create (1)
boolean
webhook.serviceMonitor.enabled (45)
true
boolean
webhook.serviceMonitor.interval (29)
1m
string
webhook.replicaCount (43)
2
number
webhook.image.repository (33)
ghcr.io/external-secrets/external-secrets
string
webhook.resources.requests.cpu (6)
10m
string
webhook.resources.requests.memory (6)
string
webhook.resources.limits.memory (5)
string
webhook.resources.limits.cpu (1)
string
webhook.certManager.enabled (5)
true
boolean
webhook.certManager.cert.issuerRef.kind (4)
ClusterIssuer
string
webhook.certManager.cert.issuerRef.name (4)
string
webhook.certManager.cert.issuerRef.group (2)
string
webhook.certManager.cert.create (1)
boolean
webhook.certManager.cert.duration (1)
string
webhook.certManager.log.level (1)
string
webhook.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].topologyKey (3)
kubernetes.io/hostname
string
webhook.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchLabels."app.kubernetes.io/name" (2)
string
webhook.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].key (1)
string
webhook.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].operator (1)
string
webhook.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].values[] (1)
string
webhook.podDisruptionBudget.enabled (3)
true
boolean
webhook.podDisruptionBudget.minAvailable (1)
number
webhook.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (2)
string
webhook.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1)
string
webhook.topologySpreadConstraints[].maxSkew (2)
number
webhook.topologySpreadConstraints[].topologyKey (2)
string
webhook.topologySpreadConstraints[].whenUnsatisfiable (2)
string
webhook.extraVolumeMounts[].mountPath (1)
string
webhook.extraVolumeMounts[].name (1)
string
webhook.extraVolumeMounts[].readOnly (1)
boolean
webhook.extraVolumes[].name (1)
string
webhook.extraVolumes[].projected.defaultMode (1)
number
webhook.extraVolumes[].projected.sources[].configMap.items[].key (1)
string
webhook.extraVolumes[].projected.sources[].configMap.items[].path (1)
string
webhook.extraVolumes[].projected.sources[].configMap.name (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
webhook.extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
webhook.extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
webhook.extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
webhook.lookaheadInterval (1)
string
webhook.priorityClassName (1)
string
webhook.serviceAccount.automount (1)
boolean
webhook.serviceAccount.create (1)
boolean
installCRDs (35)
true
boolean
image.repository (34)
ghcr.io/external-secrets/external-secrets
string
image.pullPolicy (1)
string
image.tag (1)
string
replicaCount (19)
1
number
bitwarden-sdk-server.enabled (10)
true
boolean
bitwarden-sdk-server.podAnnotations."secret.reloader.stakater.com/reload" (4)
string
bitwarden-sdk-server.securityContext.capabilities.drop[] (2)
string
bitwarden-sdk-server.securityContext.fsGroup (2)
number
bitwarden-sdk-server.securityContext.fsGroupChangePolicy (2)
string
bitwarden-sdk-server.securityContext.readOnlyRootFilesystem (2)
boolean
bitwarden-sdk-server.securityContext.runAsGroup (2)
number
bitwarden-sdk-server.securityContext.runAsNonRoot (2)
boolean
bitwarden-sdk-server.securityContext.runAsUser (2)
number
bitwarden-sdk-server.serviceMonitor.enabled (2)
boolean
bitwarden-sdk-server.serviceMonitor.interval (2)
string
bitwarden-sdk-server.resources.limits.memory (1)
string
bitwarden-sdk-server.resources.requests.cpu (1)
string
bitwarden-sdk-server.resources.requests.memory (1)
string
resources.requests.cpu (7)
10m
string
resources.requests.memory (7)
128Mi
string
resources.limits.memory (5)
string
resources.limits.cpu (1)
string
reportsController.serviceMonitor.enabled (4)
true
boolean
reportsController.serviceMonitor.interval (3)
1m
string
global.tolerations[].effect (2)
string
global.tolerations[].key (2)
string
global.tolerations[].operator (1)
string
global.nodeSelector."node-role.kubernetes.io/control-plane" (1)
string
podLabels."egress.cilium.io/kube-apiserver" (2)
string
podLabels."egress.cilium.io/nas" (2)
string
topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (2)
string
topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1)
string
topologySpreadConstraints[].maxSkew (2)
number
topologySpreadConstraints[].topologyKey (2)
string
topologySpreadConstraints[].whenUnsatisfiable (2)
string
backgroundController.serviceMonitor.enabled (1)
boolean
backgroundController.serviceMonitor.interval (1)
string
cleanupController.serviceMonitor.enabled (1)
boolean
cleanupController.serviceMonitor.interval (1)
string
createOperator (1)
boolean
extendedMetricLabels (1)
boolean
extraVolumeMounts[].mountPath (1)
string
extraVolumeMounts[].name (1)
string
extraVolumeMounts[].readOnly (1)
boolean
extraVolumes[].name (1)
string
extraVolumes[].projected.defaultMode (1)
number
extraVolumes[].projected.sources[].configMap.items[].key (1)
string
extraVolumes[].projected.sources[].configMap.items[].path (1)
string
extraVolumes[].projected.sources[].configMap.name (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.apiVersion (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].fieldRef.fieldPath (1)
string
extraVolumes[].projected.sources[].downwardAPI.items[].path (1)
string
extraVolumes[].projected.sources[].serviceAccountToken.expirationSeconds (1)
number
extraVolumes[].projected.sources[].serviceAccountToken.path (1)
string
fullnameOverride (1)
string
grafana.enabled (1)
boolean
installCRDS (1)
boolean
log.level (1)
string
podDisruptionBudget.enabled (1)
boolean
podDisruptionBudget.minAvailable (1)
number
priorityClassName (1)
string
securityContext.allowPrivilegeEscalation (1)
boolean
securityContext.capabilities.drop[] (1)
string
securityContext.readOnlyRootFilesystem (1)
boolean
securityContext.runAsNonRoot (1)
boolean
securityContext.runAsUser (1)
number
serviceAccount.automount (1)
boolean
serviceAccount.create (1)
boolean