External Secrets Operator

Syncs Kubernetes Secrets from external backends. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v2.12.0-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf

Pull:

podman pull oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf

Published 2026-10-11T06:23:15Z151.0 MiB compressed

Usage

Metrics are on in the values below; comments mark the production settings. One image covers the controller, webhook and cert-controller chart roles.

Example, not validated on this page until a matching published digest is recorded.

Image pin overlay:

image:
  repository: oci.thepeoples.io/hardened/external-secrets
  tag: "v2.12.0-tpio.1@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf"
webhook:
  image:
    repository: oci.thepeoples.io/hardened/external-secrets
    tag: "v2.12.0-tpio.1@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf"
certController:
  image:
    repository: oci.thepeoples.io/hardened/external-secrets
    tag: "v2.12.0-tpio.1@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf"

Production Helm values (metrics on, private CA only where TLS applies):

# Production-oriented Helm values for charts.external-secrets.io/external-secrets 2.12.0.
# One hardened image covers three chart roles (controller, webhook, cert-controller).
# Image pins come from catalog/image-meta.json chart_values and the generated
# values-images overlay. CRDs install with the chart.
# Example backend: Kubernetes provider in validate/manifests/eso-k8s-provider.yaml.
# Turn a metrics Service off with metrics.service.enabled / webhook.metrics.service.enabled
# / certController.metrics.service.enabled set to false.
# https://external-secrets.io/v2.12.0/introduction/getting-started/
# https://external-secrets.io/v2.12.0/api/metrics/
# https://external-secrets.io/v2.12.0/provider/kubernetes/
# https://artifacthub.io/packages/helm/external-secrets-operator/external-secrets/2.12.0

installCRDs: true

replicaCount: 2
leaderElect: true # required when replicaCount > 1
podDisruptionBudget:
  enabled: true
  minAvailable: 1

log:
  level: info
  timeEncoding: epoch

# Dedicated metrics Services (not ServiceMonitor) so Prometheus and other
# scrapers can hit /metrics without Operator CRDs.
# https://external-secrets.io/v2.12.0/api/metrics/
metrics:
  service:
    enabled: true # set false to skip the controller metrics Service
    port: 8080
serviceMonitor:
  enabled: false # set true only when Prometheus Operator CRDs are installed

securityContext:
  enabled: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  seccompProfile:
    type: RuntimeDefault
# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

resources:
  requests: {cpu: 50m, memory: 64Mi}
  limits: {cpu: 250m, memory: 256Mi}

webhook:
  create: true
  replicaCount: 2
  failurePolicy: Fail
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  metrics:
    service:
      enabled: true # set false to skip the webhook metrics Service
      port: 8080
  securityContext:
    enabled: true
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 1000
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 128Mi}

certController:
  create: true
  replicaCount: 1
  metrics:
    service:
      enabled: true # set false to skip the cert-controller metrics Service
      port: 8080
  securityContext:
    enabled: true
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 1000
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 128Mi}

bitwarden-sdk-server:
  enabled: false # not this batch

helm repo add external-secrets https://charts.external-secrets.io
helm upgrade --install external-secrets external-secrets/external-secrets --version 2.12.0 \
  --namespace external-secrets --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the Secret sync operator. Used by External Secrets Operator (controller), External Secrets Operator (webhook), External Secrets Operator (cert-controller).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf

Rebuild and licence

Same upstream digest (ladder c); distroless/static-debian13 has no apk/apt. Go-binary findings wait for ladder (b). One image covers three chart roles.

Licence: Apache-2.0.

External Secrets Operator is Apache-2.0. The distroless/static-debian13 base keeps its own licenses.

Upstream source