Chapter 11. External Secrets Operator for Red Hat OpenShift

Procedure

1. Log in to the OpenShift Container Platform web console.
2. Navigate to Ecosystem Software Catalog.
3. Enter External Secrets Operator in the search box.
4. Select the External Secrets Operator for Red Hat OpenShift from the generated list and click Install.

5. On the Install Operator page:

   1. Update the Update channel, if necessary. The channel defaults to tech-preview-v0.1, which installs the latest stable release of the External Secrets Operator.
   2. Select the version from Version drop-down list.

   3. Choose the Installed Namespace for the Operator.

      • To use the default Operator namespace, select the Operator recommended Namespace option.
      • To use the namespace that you created, select the Select a Namespace option, and then select the namespace from the drop-down list.
      • If the default external-secrets-operator namespace does not exist, it is created for you by the Operator Lifecycle Manager (OLM).

   4. Select an Update approval strategy.

      • The Automatic strategy enables OLM to automatically update the Operator when a new version is available.
      • The Manual strategy requires a user with appropriate credentials to approve the Operator update.
   5. Click Install.

Verification

1. Navigate to Ecosystem Installed Operators.
2. Verify that External Secrets Operator is listed with a Status of Succeeded in the external-secrets-operator namespace.

Procedure

1. Create a new project named external-secrets-operator by running the following command:

   $ oc new-project external-secrets-operator

   Copy to Clipboard Toggle word wrap

2. Create an OperatorGroup object by defining a YAML file with the following content:

   Example operatorGroup.yaml file

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: openshift-external-secrets-operator
     namespace: external-secrets-operator
   spec:
     targetNamespaces: []

   Copy to Clipboard Toggle word wrap

3. Create the OperatorGroup object by running the following command:

   $ oc create -f operatorGroup.yaml

   Copy to Clipboard Toggle word wrap

4. Create a Subscription object by defining a YAML file with the following content:

   Example subscription.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: openshift-external-secrets-operator
     namespace: external-secrets-operator
   spec:
     channel: tech-preview-v0.1
     name: openshift-external-secrets-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     installPlanApproval: Automatic

   Copy to Clipboard Toggle word wrap

5. Create the Subscription object by running the following command:

   $ oc create -f subscription.yaml

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the OLM subscription is created by running the following command:

   $ oc get subscription -n external-secrets-operator

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                  PACKAGE                               SOURCE          CHANNEL
   openshift-external-secrets-operator   openshift-external-secrets-operator   eso-010-index   tech-preview-v0.1

   Copy to Clipboard Toggle word wrap

2. Verify whether the Operator is successfully installed by running the following command:

   $ oc get csv -n external-secrets-operator

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                               DISPLAY                                           VERSION   REPLACES   PHASE
   external-secrets-operator.v0.1.0   External Secrets Operator for Red Hat OpenShift   0.1.0                Succeeded

   Copy to Clipboard Toggle word wrap

3. Verify that the status of the External Secrets Operator is Running by entering the following command:

   $ oc get pods -n external-secrets-operator

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                                            READY   STATUS    RESTARTS   AGE
   external-secrets-operator-controller-manager-5699f4bc54-kbsmn   1/1     Running   0          25h

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a externalsecrets.openshift.operator.io object by defining a YAML file with the following content:

   Example externalsecrets.yaml file

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecrets
   metadata:
     labels:
       app.kubernetes.io/name: external-secrets-operator
     name: cluster
   spec: {}

   Copy to Clipboard Toggle word wrap

   For more information on spec configuration, see "External Secrets Operator for Red Hat OpenShift APIs".

2. Create the externalsecrets.openshift.operator.io object by running the following command:

   $ oc create -f externalsecrets.yaml

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the external-secrets pods are running by entering the following command:

   $ oc get pods -n external-secrets

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                                READY   STATUS    RESTARTS   AGE
   external-secrets-75d47cb9c8-6p4n2                   1/1     Running   0          4h5m
   external-secrets-cert-controller-676444b897-qb6ft   1/1     Running   0          4h5m
   external-secrets-webhook-b566658ff-7m4d5            1/1     Running   0          4h5m

   Copy to Clipboard Toggle word wrap

2. Verify that the external-secrets-operator deployment object reports a successful status by running the following command:

   $ oc get externalsecrets.operator.openshift.io cluster -n external-secrets-operator -o jsonpath='{.status.conditions}' | jq .

   Copy to Clipboard Toggle word wrap

   Example output

   [
     {
       "lastTransitionTime": "2025-06-17T14:57:04Z",
       "message": "",
       "observedGeneration": 1,
       "reason": "Ready",
       "status": "False",
       "type": "Degraded"
     },
     {
       "lastTransitionTime": "2025-06-17T14:57:04Z",
       "message": "reconciliation successful",
       "observedGeneration": 1,
       "reason": "Ready",
       "status": "True",
       "type": "Ready"
     }
   ]

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the ExternalSecretsConfig CR by running the following command:

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

   Copy to Clipboard Toggle word wrap

2. Set the policy by editing the networkPolicies section:

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - name: allow-external-secrets-egress
           componentName: CoreController
           egress: # Allow all egress traffic

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the ExternalSecretsConfig CR by running the following command:

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

   Copy to Clipboard Toggle word wrap

2. Set the policy by editing the networkPolicies section. The following example shows how to allow egress to Amazon Web Services (AWS) endpoints.

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - componentName: ExternalSecretsCoreController
           egress:
             # Allow egress to Kubernetes API server, AWS endpoints, and DNS
             - ports:
                 - port: 443   # HTTPS (AWS Secrets Manager)
                   protocol: TCP
         - name: allow-external-secrets-egress

   Copy to Clipboard Toggle word wrap

   componentName

   name for the core controller specified as ExternalSecretsCoreController.

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Uninstall the External Secrets Operator for Red Hat OpenShift using the following steps:

   1. Navigate to Ecosystem Installed Operators.
   2. Click the Options menu next to the External Secrets Operator for Red Hat OpenShift entry and click Uninstall Operator.
   3. In the confirmation dialog, click Uninstall.

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Remove the deployments of the external-secrets application components in the external-secrets namespace:

   1. Click the Project drop-down menu to see a list of all available projects, and select the external-secrets project.
   2. Navigate to Workloads Deployments.
   3. Select the deployment that you want to delete.
   4. Click the Actions drop-down menu, and select Delete Deployment to see a confirmation dialog box.
   5. Click Delete to delete the deployment.

3. Remove the custom resource definitions (CRDs) that were installed by the External Secrets Operator using the following steps:

   1. Navigate to Administration CustomResourceDefinitions.
   2. Choose external-secrets.io/component: controller from the suggestions in the Label field to filter the CRDs.

   3. Click the Options menu next to each of the following CRDs, and select Delete Custom Resource Definition:

      • ACRAccessToken
      • ClusterExternalSecret
      • ClusterGenerator
      • ClusterSecretStore
      • ECRAuthorizationToken
      • ExternalSecret
      • GCRAccessToken
      • GeneratorState
      • GithubAccessToken
      • Grafana
      • Password
      • PushSecret
      • QuayAccessToken
      • SecretStore
      • STSSessionToken
      • UUID
      • VaultDynamicSecret
      • Webhook

4. Remove the external-secrets-operator namespace using the following steps:

   1. Navigate to Administration Namespaces.
   2. Click the Options menu next to the External Secrets Operator and select Delete Namespace.
   3. In the confirmation dialog, enter external-secrets-operator in the field and click Delete.

Procedure

1. Delete the deployments of the external-secrets application components in the external-secrets namespace by running the following command:

   $ oc delete deployment -n external-secrets -l app=external-secrets

   Copy to Clipboard Toggle word wrap

2. Delete the custom resource definitions (CRDs) that were installed by the External Secrets Operator by running the following command:

   $ oc delete customresourcedefinitions.apiextensions.k8s.io -l external-secrets.io/component=controller

   Copy to Clipboard Toggle word wrap

3. Delete the external-secrets-operator namespace by running the following command:

   $ oc delete project external-secrets-operator

   Copy to Clipboard Toggle word wrap

Procedure

1. Find your community Operator’s namespace by running the following command:

   $ oc get operatorconfigs.operator.external-secrets.io -A

   Copy to Clipboard Toggle word wrap

   The following is an example of finding the namespace:

   NAMESPACE             NAME        AGE
   external-secrets      cluster     9m18s

   Copy to Clipboard Toggle word wrap

2. Delete the operatorconfig by running the following command:

   $ oc delete operatorconfig <config_name> -n <operator_namespace>

   Copy to Clipboard Toggle word wrap

Verification

1. To verify that the operatorconfig was deleted, run the following command:

   $ oc get operatorconfig -n <operator_namespace>

   Copy to Clipboard Toggle word wrap

   The command must return no resource found.

2. To verify that the old webhooks are deleted, run the following commands:

   $ oc get validatingwebhookconfigurations | grep external-secrets

   Copy to Clipboard Toggle word wrap

   $ oc get mutatingwebhookconfigurations | grep external-secrets

   Copy to Clipboard Toggle word wrap

   The commands must return no results.

Procedure

1. If you installed the community External Secrets Operator by an Operator Lifecycle Manager (OLM) subscription, delete the Operator by performing the following steps:

   1. Find the subscription name by running the following command:

      $ oc get subscription -n <operator_namespace> | grep external-secrets

      Copy to Clipboard Toggle word wrap

   2. Delete the subscription by running the following command:

      $ oc delete subscription <subscription_name> -n <operator_namespace>

      Copy to Clipboard Toggle word wrap

   3. Delete the ClusterServiceVersion by running the following command:

      $ oc delete csv <csv_name> -n <operator_namespace>

      Copy to Clipboard Toggle word wrap

2. If you installed the community {external-secret-operator} by Helm, delete the Operator by running the following command:

   $ helm uninstall <release_name> -n <operator_namespace>

   Copy to Clipboard Toggle word wrap

3. If you installed the community {external-secret-operator} by raw manifests, delete the Operator by running the following command:

   $ oc delete -f /path/to/your/old/manifests.yaml -n <operator_namespace>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create an externalsecretsconfig file by defining a YAML file with the following content:

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     labels:
       app.kubernetes.io/name: cluster
     name: cluster
   spec:
     appConfig:
       logLevel: 3
     webhookConfig:
       certificateCheckInterval: 5m0s
     controllerConfig:
       certProvider:
         certManager:
           certificateDuration: 8760h0m0s
           certificateRenewBefore: 30m0s
           injectAnnotations: "true"
           issuerRef:
             group: cert-manager.io
             kind: Issuer
             name: _<created_issuer_name>_
       mode: Enabled
       networkPolicies:
       - componentName: ExternalSecretsCoreController
         egress:
         - ports:
           - port: 443
             protocol: TCP
           - port: 9998
             protocol: TCP
           name: allow-external-secrets-egress
       plugins:
         bitwardenSecretManagerProvider:
           mode: Enabled

   Copy to Clipboard Toggle word wrap

2. Create the ExternalSecretsConfig object by running the following command:

   $ oc create -f externalsecretsconfig.yaml

   Copy to Clipboard Toggle word wrap

1. To verify that the external-secrets pods are in a running state, run the following command:

   $ oc get pods -n external-secret

   Copy to Clipboard Toggle word wrap

   The following is example output that the external-secrets pods are in a running state

   NAME                                          READY        STATUS        RESTARTS     AGE
   bitwarden-sdk-server-5b4cf48766-w7zp7         1/1          Running       0            5m
   external-secrets-5854b85dd5-m6zf9             1/1          Running       0            5m
   external-secrets-webhook-5cb85b8fdb-6jtqb     1/1          Running       0            5m

   Copy to Clipboard Toggle word wrap

2. To verify that the SecretStore CR is present, run the following command:

   $ oc get secretstores.external-secrets.io -A

   Copy to Clipboard Toggle word wrap

   The following is example output from validating that the SecretStore is present:

   NAMESPACE               NAME                         AGE         STATUS      CAPABILITIES    READY
   external-secrets-1      gcp-store                    18min       Valid       ReadWrite       True
   external-secrets-2      aws-secretstore              11min       Valid       ReadWrite       True
   external-secrets        bitwarden-secretsmanager     20min       Valid       Readwrite       True

   Copy to Clipboard Toggle word wrap

3. To verify that the ExternalSecret CR is present, run the following command:

   $ oc get externalsecrets.external-secrets.io -A

   Copy to Clipboard Toggle word wrap

   The following is example output from validating that the SecretStore is present:

   NAMESPACE             NAME                    STORE                      REFRESH INTERVAL    STATUS          READY
   external-secrets-1    gcp-externalsecret      gcp-store                  1hr                 SecretSynced    True
   external-secrets-2    aws-external-secret     aws-secret-store           1hr                 SecretSynced    True
   external-secrets      bitwarden               bitwarden-secretsmanager   1hr                 SecretSynced    True

   Copy to Clipboard Toggle word wrap

4. To verify that the SecretStore is apiVersion: external-secrets.io/v1, run the following command:

   $ oc get secretstores.external-secrets.io -n external-secrets-1 gcp-store -o yaml

   Copy to Clipboard Toggle word wrap

   The following is example output that the SecretStore is apiVersion: external-secrets.io/v1.

   apiVersion: external-secrets.io/v1
   kind: SecretStore
   metadata:
     creationTimestamp: "2025-10-27T11:38:19Z"
     generation: 1
     name: gcp-store
     namespace: external-secrets-1
     resourceVersion: "104519"
     uid: 7bccb0cc-2557-4f4a-9caa-1577f0108f4b
   spec:
   .
   .
   .
   status:
     capabilities: ReadWrite
     conditions:
     - lastTransitionTime: "2025-10-27T11:38:19Z"
       message: store validated
       reason: Valid
       status: "True"
       type: Ready

   Copy to Clipboard Toggle word wrap

5. To verify that the ExternalSecret is apiVersion: external-secrets.io/v1, run the following command:

   $ oc get externalsecrets.external-secrets.io -n external-secrets-1 gcp-externalsecret -o yaml

   Copy to Clipboard Toggle word wrap

   The following is example output that the ExternalSecret is apiVersion: external-secrets.io/v1.

   apiVersion: external-secrets.io/v1
   kind: ExternalSecret
   metadata:
     creationTimestamp: "2025-10-27T11:39:03Z"
     generation: 1
     name: gcp-externalsecret
     namespace: external-secrets-1
     resourceVersion: "104532"
     uid: 93a3295a-a3ad-4304-90e1-1328d951e5fb
   spec:
   .
   .
   .
   status:
     binding:
       name: k8s-secret-gcp
     conditions:
     - lastTransitionTime: "2025-10-27T11:39:03Z"
       message: secret synced
       reason: SecretSynced
       status: "True"
       type: Ready
     refreshTime: "2025-10-27T12:13:15Z"
     syncedResourceVersion: 1-f47fe3c0b255b6dd8047cdffa772587bb829efe7a1cb70febeda2eb2

   Copy to Clipboard Toggle word wrap