Is it possible to use the k8s reflector with External Secrets?

[mvoitko]

Is it possible to use the k8s reflector with External Secrets?

[winromulus]

I would need to investigate this. I don't have an environment for this.
Can you explain more on how you would see this work?

[druesendieb]

We've used this in the past with KES (the predecessor of what you've linked) by adding the reflector annotations to spec.template.metadata.annotations in the ExternalSecret object. After having a quick look at ESO, try setting this at spec.target.template.metadata.annotations

[stale]

Automatically marked as stale due to no recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Removed stale label.

[stale]

Removed stale label.

[Rohmilchkaese]

I can in fact confirm, that this works perfectly fine

[szechp]

yes this works. here's an example for dockerconfig.json. this even carries over annotations via templating:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: some-name
  namespace: default
spec:
  refreshInterval: 3600s
  secretStoreRef:
    name: your-backend
    kind: whatever-you-use
  target:
    template:
      type: kubernetes.io/dockerconfigjson
      engineVersion: v2
      data:
        .dockerconfigjson: '{"auths":{"your.repo.url":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ list .username .password | join ":" | b64enc }}"}}}'
      templateFrom:
        - target: Annotations
          literal: |
            reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
            reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
            reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "namespace-where-you-want-to-reflect"
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: some-key
        property: docker-repo-password
    - secretKey: username
      remoteRef:
        key: some-key
        property: some-username