​
Installing the External Secrets Enterprise Bundle

This document provides instructions for installing the External Secrets Enterprise bundle, which includes both the External Secrets Operator and the Enterprise UI.

​
What’s Included

The bundle installs the following components:
  • External Secrets Enterprise: The core component for managing secrets and enterprise edition of External Secrets Operator.
  • Enterprise UI: A graphical user interface for managing secrets.
  • Enterprise Backend components: handling authentication, authorization, and other enterprise features.
  • Ingress Controller: Traefik is installed as an Ingress controller to expose the UI.

​
Installation Commands

Install the External Secrets Enterprise bundle using our Helm chart. This chart includes all the necessary components, including the web UI.
helm install esi-bundle \
    --namespace esi-bundle \
    --create-namespace \
    --set global.licenseAccepted=true \
    --set global.waitForReady=true \
    --timeout 10m \
    oci://oci.externalsecrets.com/external-secrets-inc-registry/public/charts/esi-bundle
The Helm installation will wait until everything is up and running. This can take up to 10 minutes due to image downloads.You can disable this behavior by setting global.waitForReady=false.

​
Helm Values

KeyTypeDefaultDescription
audit-listener.enabledboolfalse
audit-listener.fullnameOverridestring"audit-listener"
audit-listener.hoststring"grpc.prod.externalsecrets.com"
audit-listener.image.pullPolicystring"IfNotPresent"
audit-listener.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/audit-listener"
audit-listener.listenerIdstring"test-listener"
audit-listener.namespaceOverridestring"audit-listener"
audit-listener.portint443
audit-listener.pullSecret.createbooltrue
audit-listener.pullSecret.emailstring""
audit-listener.pullSecret.namestring"esi-registry-credentials"
audit-listener.pullSecret.valuestring""
audit-listener.tenantIdstring"test-tenant"
audit-poc-backend.affinityobject{}
audit-poc-backend.autoscaling.enabledboolfalse
audit-poc-backend.database.enabledbooltrue
audit-poc-backend.database.typestring"postgresql"
audit-poc-backend.db.adminDB.valuestring"admin"
audit-poc-backend.db.database.valuestring"admin"
audit-poc-backend.db.enabledbooltrue
audit-poc-backend.db.host.valuestring"mongodb"
audit-poc-backend.db.password.valuestring"audit_poc"
audit-poc-backend.db.port.valueint27017
audit-poc-backend.db.user.valuestring"audit_poc"
audit-poc-backend.enabledbooltrue
audit-poc-backend.fullnameOverridestring"audit-backend"
audit-poc-backend.image.pullPolicystring"IfNotPresent"
audit-poc-backend.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/audit-poc-backend"
audit-poc-backend.livenessProbeobject{}
audit-poc-backend.metrics.enabledboolfalse
audit-poc-backend.namespaceOverridestring"audit-backend"
audit-poc-backend.nodeSelectorobject{}
audit-poc-backend.podMonitor.enabledboolfalse
audit-poc-backend.readinessProbeobject{}
audit-poc-backend.resourcesobject{}
audit-poc-backend.tolerationslist[]
audit-poc-backend.volumeMountslist[]
audit-poc-backend.volumeslist[]
eso-server.enabledbooltrue
eso-server.fullnameOverridestring"eso-server"
eso-server.image.pullPolicystring"IfNotPresent"
eso-server.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/eso-server"
eso-server.namespaceOverridestring"eso-server"
eso-server.podMonitor.enabledboolfalse
eso-server.service.portint8080
eso-server.service.typestring"ClusterIP"
eso-server.tenantManager.urlstring"http://tenant-manager.tenant-manager:8080"
external-secrets.certController.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/external-secrets"
external-secrets.controller.replicasint1
external-secrets.enabledbooltrue
external-secrets.fullnameOverridestring"external-secrets"
external-secrets.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/external-secrets"
external-secrets.namespaceOverridestring"external-secrets"
external-secrets.podMonitor.enabledboolfalse
external-secrets.serviceMonitor.enabledboolfalse
external-secrets.webhook.enabledbooltrue
external-secrets.webhook.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/external-secrets"
global.certificate.enabledboolfalse
global.certificate.issuerRef.kindstring"Issuer"
global.certificate.issuerRef.namestring"you-issuer-name"
global.certificate.issuerRef.namespacestring"your-issuer-namespace"
global.certificate.secretNamestring"ingress-tls"
global.createNamespacesbooltrue
global.domains.auditBackendstring"audit-backend.external-secrets.127.0.0.1.sslip.io"
global.domains.esoServerstring"eso-server.external-secrets.127.0.0.1.sslip.io"
global.domains.tenantManagerstring"tenant-manager.external-secrets.127.0.0.1.sslip.io"
global.domains.webUistring"ui.external-secrets.127.0.0.1.sslip.io"
global.ingress.enabledbooltrue
global.ingressPortint8080
global.ingressSecurePortint8443
global.licenseFilestring"# your-enterprise-license-goes-here\n"
global.namespacestring"esi"
global.namespaces.externalSecrets.createNamespacebooltrue
global.licenseAcceptedboolfalse
global.waitForReadyboolfalse
mongodb.auth.databasestring"admin"
mongodb.auth.enabledbooltrue
mongodb.auth.passwordstring"audit_poc"
mongodb.auth.rootPasswordstring"admin123"
mongodb.auth.rootUserstring"admin"
mongodb.auth.usernamestring"audit_poc"
mongodb.enabledbooltrue
mongodb.external.adminDatabasestring"admin"
mongodb.external.databasestring"admin"
mongodb.external.hoststring"localhost"
mongodb.external.passwordstring"audit_poc"
mongodb.external.portint27017
mongodb.external.usernamestring"audit_poc"
mongodb.fullnameOverridestring"mongodb"
mongodb.global.fullnameOverridestring"mongodb"
mongodb.global.namespaceOverridestring"audit-backend"
mongodb.namespaceOverridestring"audit-backend"
mongodb.persistence.enabledbooltrue
mongodb.persistence.sizestring"8Gi"
mongodb.service.ports.mongodbint27017
mongodb.service.typestring"ClusterIP"
postgresql.auth.databasestring"tenant_manager"
postgresql.auth.enablePostgresUserbooltrue
postgresql.auth.passwordstring"tenant_manager"
postgresql.auth.postgresPasswordstring"postgres123"
postgresql.auth.usernamestring"tenant_manager"
postgresql.enabledbooltrue
postgresql.external.databasestring"tenant_manager"
postgresql.external.hoststring"localhost"
postgresql.external.passwordstring"tenant_manager"
postgresql.external.portint5432
postgresql.external.usernamestring"tenant_manager"
postgresql.fullnameOverridestring"postgresql"
postgresql.global.fullnameOverridestring"postgresql"
postgresql.global.namespaceOverridestring"tenant-manager"
postgresql.namespaceOverridestring"tenant-manager"
postgresql.primary.persistence.enabledbooltrue
postgresql.primary.persistence.sizestring"8Gi"
postgresql.primary.service.ports.postgresqlint5432
postgresql.primary.service.typestring"ClusterIP"
reloader.enabledbooltrue
reloader.fullnameOverridestring"reloader"
reloader.image.repositorystring"ghcr.io/external-secrets-inc/reloader"
reloader.namespaceOverridestring"reloader"
reloader.podMonitor.enabledboolfalse
tenant-manager.affinityobject{}
tenant-manager.bootstrap.roles.created_user.policies[0].actionstring"read"
tenant-manager.bootstrap.roles.created_user.policies[0].attrstring"*"
tenant-manager.bootstrap.roles.created_user.policies[0].regostring"package authz\nallow = true\n"
tenant-manager.bootstrap.roles.created_user.policies[0].resourcestring"*"
tenant-manager.bootstrap.roles.created_user.policies[0].rolestring"created_user_reader"
tenant-manager.bootstrap.roles.created_user.policies[1].actionstring"GET"
tenant-manager.bootstrap.roles.created_user.policies[1].attrstring"*"
tenant-manager.bootstrap.roles.created_user.policies[1].regostring"package authz\nallow = true\n"
tenant-manager.bootstrap.roles.created_user.policies[1].resourcestring"*"
tenant-manager.bootstrap.roles.created_user.policies[1].rolestring"created_user_getter"
tenant-manager.bootstrap.roles.created_user.policies[2].actionstring"POST"
tenant-manager.bootstrap.roles.created_user.policies[2].attrstring"*"
tenant-manager.bootstrap.roles.created_user.policies[2].regostring"package authz\nallow = true\n"
tenant-manager.bootstrap.roles.created_user.policies[2].resourcestring"/api/authz/check"
tenant-manager.bootstrap.roles.created_user.policies[2].rolestring"check_authz"
tenant-manager.bootstrap.roles.signup_user.policies[0].actionstring"*"
tenant-manager.bootstrap.roles.signup_user.policies[0].attrstring"*"
tenant-manager.bootstrap.roles.signup_user.policies[0].regostring"package authz\nallow = true\n"
tenant-manager.bootstrap.roles.signup_user.policies[0].resourcestring"*"
tenant-manager.bootstrap.roles.signup_user.policies[0].rolestring"signup_user_admin"
tenant-manager.enabledbooltrue
tenant-manager.fullnameOverridestring"tenant-manager"
tenant-manager.image.pullPolicystring"IfNotPresent"
tenant-manager.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/tenant-manager"
tenant-manager.livenessProbeobject{}
tenant-manager.metrics.enabledboolfalse
tenant-manager.namespaceOverridestring"tenant-manager"
tenant-manager.nodeSelectorobject{}
tenant-manager.podMonitor.enabledboolfalse
tenant-manager.readinessProbeobject{}
tenant-manager.resourcesobject{}
tenant-manager.sql.enabledbooltrue
tenant-manager.sql.host.valuestring"postgresql"
tenant-manager.sqlProxy.enabledboolfalse
tenant-manager.tolerationslist[]
tenant-manager.volumeMountslist[]
tenant-manager.volumeslist[]
traefik.enabledboolfalse
traefik.fullnameOverridestring"traefik"
traefik.namespaceOverridestring"traefik"
traefik.service.typestring"LoadBalancer"
web-ui.enabledbooltrue
web-ui.fullnameOverridestring"web-ui"
web-ui.image.pullPolicystring"IfNotPresent"
web-ui.image.repositorystring"us-central1-docker.pkg.dev/external-secrets-inc-registry/public/web-ui"
web-ui.namespaceOverridestring"web-ui"
web-ui.podMonitor.enabledboolfalse