NAME
IO::K8s::ExternalSecrets::V1::AzureKVProvider - AzureKV configures this store to sync secrets using Azure Key Vault provider
VERSION
version 1.108
authSecretRef
Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
authType
Auth type defines how to authenticate to the keyvault service. Valid values are: - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret) - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity) - "WorkloadIdentity": Using a Kubernetes ServiceAccount federated with Entra ID
customCloudConfig
CustomCloudConfig defines custom Azure endpoints for non-standard clouds. Required when EnvironmentType is AzureStackCloud. Optional for other environment types - useful for Azure China when using Workload Identity with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the standard China Cloud endpoint (login.chinacloudapi.cn). IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud configuration is not supported with the legacy go-autorest SDK.
environmentType
EnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud, AzureStackCloud Use AzureStackCloud when you need to configure custom Azure Stack Hub or Azure Stack Edge endpoints.
identityId
If multiple Managed Identity is assigned to the pod, you can select the one to be used
serviceAccountRef
ServiceAccountRef specified the service account that should be used when authenticating with WorkloadIdentity.
tenantId
TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
useAzureSDK
UseAzureSDK enables the use of the new Azure SDK for Go (azcore-based) instead of the legacy go-autorest SDK. This is experimental and may have behavioral differences. Defaults to false (legacy SDK).
vaultUrl
Vault Url from which the secrets to be fetched from.
SUPPORT
Issues
Please report bugs and feature requests on GitHub at https://github.com/pplu/io-k8s-p5/issues.
CONTRIBUTING
Contributions are welcome! Please fork the repository and submit a pull request.
AUTHORS
Torsten Raudssus <getty@cpan.org>
Jose Luis Martinez Torres <jlmartin@cpan.org>
COPYRIGHT AND LICENSE
This software is Copyright (c) 2018-2026 by Jose Luis Martinez Torres <jlmartin@cpan.org>.
This is free software, licensed under:
The Apache License, Version 2.0, January 2004