ESO PushSecret composition

The operator only exports rotated tokens to Kubernetes Secrets. For anything else — external vaults, webhook endpoints, multi-cluster sync — the supported pattern is External Secrets Operator PushSecret, which references the Secret the operator writes and pushes it to any configured SecretStore.

Push to an external vault

apiVersion: external-secrets.io/v1beta1
kind: PushSecret
metadata:
  name: gitlab-ci-token-to-vault
spec:
  selector:
    secret:
      name: gitlab-ci-token       # the Secret our operator writes
  secretStoreRefs:
    - name: vault
      kind: ClusterSecretStore
  data:
    - match:
        secretKey: token
        remoteRef:
          remoteKey: secret/gitlab/ci-token

Push to a webhook

ESO has a webhook provider. Configure a SecretStore with provider: webhook, point a PushSecret at it, and ESO POSTs the secret value on change.

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: rotation-webhook
spec:
  provider:
    webhook:
      url: "https://my-endpoint.example.com/rotated"
      method: POST
      headers:
        Content-Type: application/json
      body: |
        {"token": "{{ .token }}"}
---
apiVersion: external-secrets.io/v1beta1
kind: PushSecret
metadata:
  name: gitlab-ci-token-webhook
spec:
  selector:
    secret:
      name: gitlab-ci-token
  secretStoreRefs:
    - name: rotation-webhook
  data:
    - match:
        secretKey: token
        remoteRef:
          remoteKey: token

Why not a native webhook field on the CR?

ESO's webhook provider solves the problem — auth, TLS, body templating, retries — better than we would. See Resolutions to open questions §3.