12.3.5. Installing the External Secrets operand by using the CLI

Procedure

1. Create an externalsecretsconfig.openshift.operator.io object by defining a YAML file with the following content:

   Example externalsecretsconfig.yaml file.

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     labels:
       app: external-secrets-operator
       app.kubernetes.io/name: cluster
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
       - componentName: ExternalSecretsCoreController
         egress:
         - {}
         name: allow-external-secrets-egress

   For more information on spec configuration, see "External Secrets Operator for Red Hat OpenShift APIs".

2. Create the externalsecretsconfigs.openshift.operator.io object by running the following command:

   $ oc create -f externalsecretsconfig.yaml

Verification

1. Verify that the external-secrets pods are running by entering the following command:

   $ oc get pods -n external-secrets

   Example output

   NAME                                                READY   STATUS    RESTARTS   AGE
   external-secrets-75d47cb9c8-6p4n2                   1/1     Running   0          4h5m
   external-secrets-cert-controller-676444b897-qb6ft   1/1     Running   0          4h5m
   external-secrets-webhook-b566658ff-7m4d5            1/1     Running   0          4h5m

2. Verify that the external-secrets-operator deployment object reports a successful status by running the following command:

   $ oc get externalsecretsconfig.operator.openshift.io cluster -n external-secrets-operator -o jsonpath='{.status.conditions}' | jq .

   Example output

   [
     {
       "lastTransitionTime": "2025-06-17T14:57:04Z",
       "message": "",
       "observedGeneration": 2,
       "reason": "Ready",
       "status": "False",
       "type": "Degraded"
     },
     {
       "lastTransitionTime": "2025-11-27T05:58:38Z,
       "message": "reconciliation successful",
       "observedGeneration": 2,
       "reason": "Ready",
       "status": "True",
       "type": "Ready"
     }
   ]