external-secrets chart

Giant Swarm offers an external-secrets App which can be installed in workload clusters. Here we define the external-secrets chart with its templates and default configuration.

Installing

This app is a cluster singleton: install it only once per workload cluster.

The recommended way to install this app onto a workload cluster is a Flux HelmRelease:

• Deploying an application via a Flux HelmRelease
• Adding a HelmRelease via GitOps

As a fallback, the legacy App Platform (deprecated) is still supported:

• By creating an App resource in the management cluster as explained in Deploying an app (legacy App CR).
• Using GitOps to add an App CR

Configuring

values.yaml

This is an example of a values file that disables the ClusterGenerator CRD and its controller. Both settings are needed together. See values.yaml for all options.

# values.yaml
crds:
  createClusterGenerator: false
processClusterGenerator: false

Deploying with kubectl-gs

You can use the official Giant Swarm kubectl plug-in to create the Flux OCIRepository and HelmRelease in the management cluster.

Here is an example that would install the app to workload cluster abc123 of organization example:

kubectl gs deploy chart \
  --chart-name external-secrets \
  --version 2.11.0 \
  --organization example \
  --target-cluster abc123 \
  --target-namespace external-secrets \
  --values-file values.yaml

Add --dry-run to print the manifests without applying them.

See the kubectl gs deploy chart reference for all options.

Credit

• https://github.com/external-secrets/external-secrets