Arkanis.Aspire.Hosting.Extensions.Kubernetes.ExternalSecrets 1.0.0-dev.7

Arkanis.Aspire.Hosting.Extensions.Kubernetes.ExternalSecrets

.NET Aspire hosting extensions for publishing External Secrets Operator manifests from AppHost configuration. This package adds Kubernetes environment helpers, ExternalSecret builders, and 1Password External Secrets remote-reference mapping.

Installation

dotnet add package Arkanis.Aspire.Hosting.Extensions.Kubernetes.ExternalSecrets

Quick Start

using Aspire.Hosting;
using Aspire.Hosting.Extensions.Kubernetes.ExternalSecrets;
using Aspire.Hosting.Extensions.Kubernetes.ExternalSecrets.OnePassword;

var builder = DistributedApplication.CreateBuilder(args);

var apiKey = builder.AddParameter("ApiKey", secret: true);
var api = builder.AddProject<Projects.Api>("api");
var kubernetes = builder.AddKubernetesEnvironment("kubernetes");

api.WithKubernetesExternalSecret("api-secrets", secret => secret
    .MapOnePasswordParameter("ApiKey", apiKey, builder.Configuration)
    .InKubernetesEnvironment(kubernetes));

builder.Build().Run();

WithKubernetesExternalSecret(...) emits the explicit ExternalSecret manifest during Kubernetes publish. It does not require a separate environment-level WithExternalSecrets(...) call.

Configure environment defaults when multiple resource-local ExternalSecrets should share a store reference or refresh interval.

kubernetes.WithExternalSecrets(ExternalSecretsOptions.FromConfiguration(builder.Configuration));

You can also configure those defaults in code.

kubernetes.WithExternalSecrets(secrets => secrets
    .WithSecretStore(ExternalSecretStoreOptions.ClusterSecretStore("shared-store"))
    .WithRefreshInterval("30m"));

api.WithKubernetesExternalSecret("api-secrets", secret => secret
    .MapRemoteSecret("ApiKey", apiKey, remoteKey: "Shared/API", remoteProperty: "credential")
    .InKubernetesEnvironment(kubernetes));

builder.Build().Run();

Secret Reload Restarts

WithKubernetesExternalSecret(...) rewrites matching generated environment variables to read from the ExternalSecret target Secret. When it emits those secretKeyRef entries, the generated Deployment metadata receives reloader.stakater.com/auto: "true" so Stakater Reloader can roll the workload after the referenced Secret changes.

api.WithKubernetesExternalSecret("api-secrets", secret =>
    secret.MapOnePasswordParameter(
        "ApiKey",
        apiKey,
        builder.Configuration));

api.WithoutSecretReloadRestart();

Use WithoutSecretReloadRestart() only for workloads that must not restart automatically after a referenced Kubernetes Secret rotates.

Scope

This package emits External Secrets Operator resource intent during Aspire publish. It does not install External Secrets Operator, create a cluster secret store, or grant live-cluster access.

Dependency

This package references Arkanis.Aspire.Hosting.Extensions.Kubernetes.

Repository

Source, issues, and release workflow details are available at https://github.com/ArkanisCorporation/Aspire.Hosting.Extensions.Kubernetes.