Chapter 11. External Secrets Operator for Red Hat OpenShift

Procedure

1. Log in to the OpenShift Container Platform web console.
2. Navigate to Operators OperatorHub.
3. Enter External Secrets Operator in the search box.
4. Select the External Secrets Operator for Red Hat OpenShift from the generated list and click Install.

5. On the Install Operator page:

   1. Update the Update channel, if necessary. The channel defaults to tech-preview-v0.1, which installs the latest stable release of the External Secrets Operator.
   2. Select the version from Version drop-down list.

   3. Choose the Installed Namespace for the Operator.

      • To use the default Operator namespace, select the Operator recommended Namespace option.
      • To use the namespace that you created, select the Select a Namespace option, and then select the namespace from the drop-down list.
      • If the default external-secrets-operator namespace does not exist, it is created for you by the Operator Lifecycle Manager (OLM).

   4. Select an Update approval strategy.

      • The Automatic strategy enables OLM to automatically update the Operator when a new version is available.
      • The Manual strategy requires a user with appropriate credentials to approve the Operator update.
   5. Click Install.

Verification

1. Navigate to Operators Installed Operators.
2. Verify that External Secrets Operator is listed with a Status of Succeeded in the external-secrets-operator namespace.

Procedure

1. Create a new project named external-secrets-operator by running the following command:

   $ oc new-project external-secrets-operator

   Copy to Clipboard

2. Create an OperatorGroup object by defining a YAML file with the following content:

   Example operatorGroup.yaml file

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: openshift-external-secrets-operator
     namespace: external-secrets-operator
   spec:
     targetNamespaces: []

   Copy to Clipboard

3. Create the OperatorGroup object by running the following command:

   $ oc create -f operatorGroup.yaml

   Copy to Clipboard

4. Create a Subscription object by defining a YAML file with the following content:

   Example subscription.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: openshift-external-secrets-operator
     namespace: external-secrets-operator
   spec:
     channel: tech-preview-v0.1
     name: openshift-external-secrets-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     installPlanApproval: Automatic

   Copy to Clipboard

5. Create the Subscription object by running the following command:

   $ oc create -f subscription.yaml

   Copy to Clipboard

Verification

1. Verify that the OLM subscription is created by running the following command:

   $ oc get subscription -n external-secrets-operator

   Copy to Clipboard

   Example output

   NAME                                  PACKAGE                               SOURCE          CHANNEL
   openshift-external-secrets-operator   openshift-external-secrets-operator   eso-010-index   tech-preview-v0.1

   Copy to Clipboard

2. Verify whether the Operator is successfully installed by running the following command:

   $ oc get csv -n external-secrets-operator

   Copy to Clipboard

   Example output

   NAME                               DISPLAY                                           VERSION   REPLACES   PHASE
   external-secrets-operator.v0.1.0   External Secrets Operator for Red Hat OpenShift   0.1.0                Succeeded

   Copy to Clipboard

3. Verify that the status of the External Secrets Operator is Running by entering the following command:

   $ oc get pods -n external-secrets-operator

   Copy to Clipboard

   Example output

   NAME                                                            READY   STATUS    RESTARTS   AGE
   external-secrets-operator-controller-manager-5699f4bc54-kbsmn   1/1     Running   0          25h

   Copy to Clipboard

Procedure

1. Create a externalsecrets.openshift.operator.io object by defining a YAML file with the following content:

   Example externalsecrets.yaml file

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecrets
   metadata:
     labels:
       app.kubernetes.io/name: external-secrets-operator
     name: cluster
   spec: {}

   Copy to Clipboard

   For more information on spec configuration, see "External Secrets Operator for Red Hat OpenShift APIs".

2. Create the externalsecrets.openshift.operator.io object by running the following command:

   $ oc create -f externalsecrets.yaml

   Copy to Clipboard

Verification

1. Verify that the external-secrets pods are running by entering the following command:

   $ oc get pods -n external-secrets

   Copy to Clipboard

   Example output

   NAME                                                READY   STATUS    RESTARTS   AGE
   external-secrets-75d47cb9c8-6p4n2                   1/1     Running   0          4h5m
   external-secrets-cert-controller-676444b897-qb6ft   1/1     Running   0          4h5m
   external-secrets-webhook-b566658ff-7m4d5            1/1     Running   0          4h5m

   Copy to Clipboard

2. Verify that the external-secrets-operator deployment object reports a successful status by running the following command:

   $ oc get externalsecrets.operator.openshift.io cluster -n external-secrets-operator -o jsonpath='{.status.conditions}' | jq .

   Copy to Clipboard

   Example output

   [
     {
       "lastTransitionTime": "2025-06-17T14:57:04Z",
       "message": "",
       "observedGeneration": 1,
       "reason": "Ready",
       "status": "False",
       "type": "Degraded"
     },
     {
       "lastTransitionTime": "2025-06-17T14:57:04Z",
       "message": "reconciliation successful",
       "observedGeneration": 1,
       "reason": "Ready",
       "status": "True",
       "type": "Ready"
     }
   ]

   Copy to Clipboard

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Uninstall the External Secrets Operator for Red Hat OpenShift using the following steps:

   1. Navigate to Operators Installed Operators.
   2. Click the Options menu next to the External Secrets Operator for Red Hat OpenShift entry and click Uninstall Operator.
   3. In the confirmation dialog, click Uninstall.

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Remove the deployments of the external-secrets application components in the external-secrets namespace:

   1. Click the Project drop-down menu to see a list of all available projects, and select the external-secrets project.
   2. Navigate to Workloads Deployments.
   3. Select the deployment that you want to delete.
   4. Click the Actions drop-down menu, and select Delete Deployment to see a confirmation dialog box.
   5. Click Delete to delete the deployment.

3. Remove the custom resource definitions (CRDs) that were installed by the External Secrets Operator using the following steps:

   1. Navigate to Administration CustomResourceDefinitions.
   2. Choose external-secrets.io/component: controller from the suggestions in the Label field to filter the CRDs.

   3. Click the Options menu next to each of the following CRDs, and select Delete Custom Resource Definition:

      • ACRAccessToken
      • ClusterExternalSecret
      • ClusterGenerator
      • ClusterSecretStore
      • ECRAuthorizationToken
      • ExternalSecret
      • GCRAccessToken
      • GeneratorState
      • GithubAccessToken
      • Grafana
      • Password
      • PushSecret
      • QuayAccessToken
      • SecretStore
      • STSSessionToken
      • UUID
      • VaultDynamicSecret
      • Webhook

4. Remove the external-secrets-operator namespace using the following steps:

   1. Navigate to Administration Namespaces.
   2. Click the Options menu next to the External Secrets Operator and select Delete Namespace.
   3. In the confirmation dialog, enter external-secrets-operator in the field and click Delete.

Procedure

1. Delete the deployments of the external-secrets application components in the external-secrets namespace by running the following command:

   $ oc delete deployment -n external-secrets -l app=external-secrets

   Copy to Clipboard

2. Delete the custom resource definitions (CRDs) that were installed by the External Secrets Operator by running the following command:

   $ oc delete customresourcedefinitions.apiextensions.k8s.io -l external-secrets.io/component=controller

   Copy to Clipboard

3. Delete the external-secrets-operator namespace by running the following command:

   $ oc delete project external-secrets-operator

   Copy to Clipboard