# Install External Secrets Operator

> [HTML Version](install-external-secrets-operator.html)

The External Secrets Operator is a Kubernetes operator that integrates external secret management systems, such as HashiCorp Vault. The operator reads information from external APIs and automatically creates Kubernetes secrets.  
The installation of the External Secrets Operator consists of several steps:

1. [Download the Helm chart and configuration file for the External Secrets Operator](#install-helm-and-eso).

2. [Fill out the configuration file for the External Secrets Operator](#config-file-eso).

3. [Install the External Secrets Operator using Helm in the Kubernetes cluster](#install-eso).

4. [Configure the brix365-db-connections secret creation parameter in the brix365 Helm chart](#elma365-db-connections).

## Step 1: Download the Helm chart and configuration file for the External Secrets Operator

To install via the internet, obtain the configuration file \[OBJECT\] by executing the following command:

````
helm repo add brix365 https://charts.brix365.com   
helm repo update  
helm show values brix365/external-secrets > values-external-secrets.yaml

````
Obtaining the configuration file for offline installation without internet access

1. On a computer with internet access, download the BRIX images and upload them to a local image registry by executing the following commands:

````
helm repo add brix365 https://charts.brix365.com   
helm repo update  
helm pull brix365/external-secrets

````
  
For more details see [Download BRIX images](downloadin-images-elma365.md).

2. Copy the downloaded archive of the chart **external-secrets-X.Y.Z.tgz** to the server where the installation will take place.

3. Unpack the chart and copy the default configuration file \[OBJECT\] to \[OBJECT\]:

````
tar -xf external-secrets-X.Y.Z.tgz  
cp external-secrets/values.yaml values-external-secrets.yaml
````

## ````
Step 2: Fill out the configuration file for the External Secrets Operator

Fill out the \[OBJECT\] configuration file for installing the **external-secrets** service:

1. In parameter \[OBJECT\] specify the \[OBJECT\] where BRIX is installed.

2. In parameter \[OBJECT\] replace **http://vault-server.vault:8200/** with the address, where the **Vault** service is accessible. In the example below, the **Vault** service is installed in in Kubernetes in the **vault** \[OBJECT\].

3. In parameters \[OBJECT\], \[OBJECT\] and \[OBJECT\] specify the \[OBJECT\] secret management mechanism in **Vault**.

4. In parameters \[OBJECT\] and \[OBJECT\] specify the service account and role that link the policy to the Kubernetes service account.

5. In parameters of the \[OBJECT\] section, specify the secret keys in **Vault**.

````
\# external-secrets settings  
external-secrets:  
\# Configure secret for brix365-db-connections  
  brix365DBConnections:  
\# namespace where BRIX will be installed and the secret will be created (must be created before installation)  
    namespace: brix365  
\# vault server address  
    serverVault: "http://vault-server.vault:8200"  
\# path where the kv secret mechanism is enabled  
    kvPath: "secret"  
\# path to the secret in vault  
    keyPath: "brix365/db"  
\# version of the kv secret mechanism  
    kvVersion: "v2"  
\# role that link the policy to the Kubernetes service account  
    authKubernetesRole: "read-secret-brix365"  
\# service account in the Kubernetes cluster  
    authKubernetesServiceAccount: "vault-auth"  
\# secret keys in vault  
    key:  
      psqlUrl: PSQL\_URL  
      roPsqlUrl: RO\_POSTGRES\_URL  
      poolPsqlUrl: brix365\_POOL\_POSTGRES\_URL  
      mongoUrl: MONGO\_URL  
      amqpUrl: AMQP\_URL  
      redisUrl: REDIS\_URL  
      vahterMongoUrl: VAHTER\_MONGO\_URL  
      s3BackendAddress: S3\_BACKEND\_ADDRESS  
      s3BackendRegion: S3\_REGION  
      s3Bucket: S3\_BUCKET  
      s3Key: S3\_KEY  
      s3SecretAccessKey: S3\_SECRET  
      s3SslEnabled: S3\_SSL\_ENABLED  
      s3Method: S3\_UPLOAD\_METHOD  
      s3DumpUrl: S3\_DUMP\_URL  
      s3VirtualHostedStyleEnabled: S3\_VIRTUAL\_HOSTED\_STYLE\_ENABLED  
\# number of replicas for high availability  
  replicaCount: 1  
\# CRD are applied automatically from the /crds directory  
  installCRDs: false  
...

````
Filling in the connection parameters for a private registry without internet access involves the following steps:

  
To connect to a private **registry**:

1. Download the BRIX images and upload them to a local image registry. For more details, see [Download BRIX images](downloadin-images-elma365.md).

2. Specify the address and path in parameters \[OBJECT\], \[OBJECT\], \[OBJECT\].

3. Indicate the name of the secret with access rights to the private **registry** in the parameter \[OBJECT\]. he secret must be created manually and encoded in Base64.

````
\# Settings for external-secrets  
external-secrets:  
...  
\# Parameters for connecting to the private registry  
  image:  
    repository: hub.brix365.com/docker/addons/external-secrets/external-secrets  
    tag: v0.10.2  
\# The secret with access rights to the private registry must be created manually and encoded in Base64  
  imagePullSecrets:  
      - name: "myRegistryKeySecretName"  
  webhook:  
\# Parameters for connecting to the private registry  
    image:  
      repository: hub.brix365.com/docker/addons/external-secrets/external-secrets  
      tag: v0.10.2  
\# The secret with access rights to the private registry must be created manually and encoded in Base64  
    imagePullSecrets:  
      - name: "myRegistryKeySecretName"  
  certController:  
\# Parameters for connecting to the private registry  
    image:  
      repository: hub.brix365.com/docker/addons/external-secrets/external-secrets  
      tag: v0.10.2  
\# The secret with access rights to the private registry must be created manually and encoded in Base64  
    imagePullSecrets:  
      - name: "myRegistryKeySecretName"

````
where the format of **repository **is:

- address is \[OBJECT\];

- path is \[OBJECT\].

## Step 3: Install the External Secrets Operator using Helm in the Kubernetes cluster

Install the **external-secrets** service in a separate \[OBJECT\], for example, **external-secrets**. This \[OBJECT\] will be created during installation if it doesn't already exist.

To install via the internet, execute the command:

````
helm upgrade --install external-secrets brix365/external-secrets -f values-external-secrets.yaml -n external-secrets --create-namespace 

````
For offline installation without internet access, navigate to the directory with the downloaded chart and execute the command:

````
helm upgrade --install external-secrets ./external-secrets -f values-external-secrets.yaml -n external-secrets --create-namespace

````
Make sure that the **external-secrets** service has been created:

````
kubectl get external-secrets -n brix365

````
Check the created secret:

````
kubectl describe secrets brix365-db-connections -n brix365 

## ````
Step 4: Configure the brix365-db-connections secret creation parameter in the brix365 Helm chart

Before installing or upgrading the BRIX Helm chart, you need to disable the creation of the \[OBJECT\] secret with the \[OBJECT\] configuration file parameters. To do this, set the \[OBJECT\] value to false in the parameter \[OBJECT\] in \[OBJECT\].

For more details on installing and updating BRIX, see [Install BRIX in Kubernetes](installing-elma365-enterprise.md) and [Update version of BRIX On-Premises](version-update-enterprise.md).

## Uninstall the External Secrets Operator chart using Helm in the Kubernetes Cluster

To remove the **external-secrets** service in the **external-secrets** \[OBJECT\], run the following command:

````
helm uninstall external-secrets -n external-secrets
````