/usr/bin/external-secrets

For more information visit https://external-secrets.io

Usage:
  external-secrets [flags]
  external-secrets [command]

Available Commands:
  certcontroller Controller to manage certificates for external secrets CRDs and ValidatingWebhookConfigs
  completion     Generate the autocompletion script for the specified shell
  help           Help about any command
  webhook        Webhook implementation for ExternalSecrets and SecretStores.

Flags:
      --client-burst int                            Maximum Burst allowed to be passed to rest.Client (default 100)
      --client-qps float32                          QPS configuration to be passed to rest.Client (default 50)
      --concurrent int                              The number of concurrent reconciles. (default 1)
      --controller-class string                     The controller is instantiated with a specific controller name and filters ES based on this property (default "default")
      --doppler-etag-cache-size int                 Maximum size of Doppler ETag-based secrets cache. Set to 0 to disable caching. (default 16384)
      --enable-cluster-external-secret-reconciler   Enable cluster external secret reconciler. (default true)
      --enable-cluster-push-secret-reconciler       Enable cluster push secret reconciler. (default true)
      --enable-cluster-store-reconciler             Enable cluster store reconciler. (default true)
      --enable-configmaps-caching                   Enable configmaps caching for ALL configmaps in the cluster (WARNING: can increase memory usage).
      --enable-extended-metric-labels               Enable recommended kubernetes annotations as labels in metrics.
      --enable-flood-gate                           Enable flood gate. External secret will be reconciled only if the ClusterStore or Store have an healthy or unknown state. (default true)
      --enable-generator-state                      Whether the Controller should manage GeneratorState (default true)
      --enable-http2                                If set, HTTP/2 will be enabled for the metrics server
      --enable-leader-election                      Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --enable-managed-secrets-caching              Enable secrets caching for secrets managed by an ExternalSecret (default true)
      --enable-push-secret-reconciler               Enable push secret reconciler. (default true)
      --enable-secret-api-read-on-cache-mismatch    Enable a direct API read when the partial Secret cache and managed Secret cache disagree. Disable to rely on cache retry only. (default true)
      --enable-secret-store-reconciler              Enable secret store reconciler. (default true)
      --enable-secrets-caching                      Enable secrets caching for ALL secrets in the cluster (WARNING: can increase memory usage).
      --enable-vault-token-cache                    Enable Vault token cache. External secrets will reuse the Vault token without creating a new one on each request.
      --experimental-doppler-oidc-cache-size int    Maximum size of Doppler OIDC provider cache. Set to 0 to disable caching. Only used if --experimental-enable-doppler-oidc-cache is set. (default 262144)
      --experimental-enable-doppler-oidc-cache      Enable experimental Doppler OIDC provider cache.
      --experimental-enable-vault-token-cache       Enable Vault token cache. External secrets will reuse the Vault token without creating a new one on each request.
      --experimental-vault-token-cache-size int     Maximum size of Vault token cache. Only used if --experimental-enable-vault-token-cache is set. (default 262144)
      --generator-gc-grace-period duration          Duration after which generated secrets are cleaned up after they have been flagged for gc. (default 2m0s)
  -h, --help                                        help for external-secrets
      --live-addr string                            The address the live endpoint binds to. (default ":8082")
      --loglevel string                             loglevel to use, one of: debug, info, warn, error, dpanic, panic, fatal (default "info")
      --metrics-addr string                         The address the metric endpoint binds to. (default ":8080")
      --metrics-cert-dir string                     Directory containing TLS certificate and key for metrics endpoint.
      --metrics-cert-name string                    TLS certificate filename for metrics endpoint. (default "tls.crt")
      --metrics-key-name string                     TLS key filename for metrics endpoint. (default "tls.key")
      --metrics-secure                              Enable HTTPS for the metrics endpoint.
      --mysterybox-connections-cache-size int       Size of Nebius MysteryBox grpc clients cache. External secrets will reuse the connection to MysteryBox for the configuration without opening a new one on each request. (default 128)
      --mysterybox-tokens-cache-size int            Size of Nebius MysteryBox token cache. External secrets will reuse the Nebius IAM token without requesting a new one on each request. (default 4096)
      --namespace string                            watch external secrets scoped in the provided namespace only. ClusterSecretStore can be used but only work if it doesn't reference resources from other namespaces
      --store-requeue-interval duration             Default Time duration between reconciling (Cluster)SecretStores (default 5m0s)
      --template-left-delimiter string              templating left delimiter (default "{{")
      --template-right-delimiter string             templating right delimiter (default "}}")
      --unsafe-allow-generic-targets                Enable support for creating generic resources (ConfigMaps, Custom Resources). WARNING: Using generic resources, please sure all policies are correctly configured.
      --vault-token-cache-size int                  Maximum size of Vault token cache. Only used if --enable-vault-token-cache is set. (default 262144)
      --zap-time-encoding string                    Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano') (default "epoch")

Use "external-secrets [command] --help" for more information about a command.