external secrets Bitwarden support using webhook provider How does it work External Secrets Operator 0 8 0 Multiple Cluster SecretStores using the webhook provider To make external secrets compatible with Bitwarden we need Bitwarden is an integrated open source password management solution for individuals teams and business organizations

Answer:
# Bitwarden support using webhook provider

Bitwarden is an integrated open source password management solution for individuals, teams, and business organizations.

## How does it work?

To make external-secrets compatible with Bitwarden, we need:

* External Secrets Operator >= 0.8.0
* Multiple (Cluster)SecretStores using the webhook provider
* BitWarden CLI image running `bw serve`

When you create a new external-secret object, the External Secrets webhook provider will query the Bitwarden CLI pod that is synced with the Bitwarden server.

## Requirements

* Bitwarden account (it also works with Vaultwarden!)
* A Kubernetes secret which contains your Bitwarden credentials
* A Docker image running the Bitwarden CLI. You could use `ghcr.io/charlesthomas/bitwarden-cli:2023.12.1` or build your own.

Here is an example of a Dockerfile used to build the image:
```dockerfile
FROM debian:sid

ENV BW_CLI_VERSION=2023.12.1

RUN apt update && \
    apt install -y wget unzip && \
    wget https://github.com/bitwarden/clients/releases/download/cli-v${BW_CLI_VERSION}/bw-linux-${BW_CLI_VERSION}.zip && \
    unzip bw-linux-${BW_CLI_VERSION}.zip && \
    chmod +x bw && \
    mv bw /usr/local/bin/bw && \
    rm -rfv *.zip

COPY entrypoint.sh /

CMD ["/entrypoint.sh"]
```

And the content of `entrypoint.sh`:
```bash
#!/bin/bash

set -e

bw config server ${BW_HOST}

export BW_SESSION=$(bw login ${BW_USER} --passwordenv BW_PASSWORD --raw)

bw unlock --check

echo 'Running `bw server` on port 8087'
bw serve --hostname 0.0.0.0 #--disable-origin-protection
```

## Deploy Bitwarden credentials

```yaml
{% include 'bitwarden-cli-secrets.yaml' %}
```

## Deploy Bitwarden CLI container

```yaml
{% include 'bitwarden-cli-deployment.yaml' %}
```

> NOTE: Deploying a network policy is recommended since there is no authentication to query the Bitwarden CLI, which means that your secrets are exposed.

> NOTE: In this example the Liveness probe is querying /sync to ensure that the Bitwarden CLI is able to connect to the server and is also synchronised. (The secret sync is only every 2 minutes in this example)

## Deploy (Cluster)SecretStores

There are four possible (Cluster)SecretStores to deploy, each can access different types of fields from an item in the Bitwarden vault. It is not required to deploy them all.

```yaml
{% include 'bitwarden-secret-store.yaml' %}
```

## Usage

(Cluster)SecretStores:

* `bitwarden-login`: Use to get the `username` or `password` fields
* `bitwarden-fields`: Use to get custom fields
* `bitwarden-notes`: Use to get notes
* `bitwarden-attachments`: Use to get attachments

remoteRef:

* `key`: ID of a secret, which can be found in the URL `itemId` parameter:
  `https://myvault.com/#/vault?type=login&itemId=........-....-....-....-............`s

* `property`: Name of the field to access
    * `username` for the username of a secret (`bitwarden-login` SecretStore)
    * `password` for the password of a secret (`bitwarden-login` SecretStore)
    * `name_of_the_custom_field` for any custom field (`bitwarden-fields` SecretStore)
    * `id_or_name_of_the_attachment` for any attachment (`bitwarden-attachment`, SecretStore)

```yaml
{% include 'bitwarden-secret.yaml' %}
```

Bitwarden support using webhook provider  Bitwarden is an integrated open source password management solution for individuals  teams  and business organizations      How does it work   To make external secrets compatible with Bitwarden  we need     External Secrets Operator    0 8 0   Multiple  Cluster SecretStores using the webhook provider   BitWarden CLI image running  bw serve   When you create a new external secret object  the External Secrets webhook provider will query the Bitwarden CLI pod that is synced with the Bitwarden server      Requirements    Bitwarden account  it also works with Vaultwarden     A Kubernetes secret which contains your Bitwarden credentials   A Docker image running the Bitwarden CLI  You could use  ghcr io charlesthomas bitwarden cli 2023 12 1  or build your own   Here is an example of a Dockerfile used to build the image     dockerfile FROM debian sid  ENV BW CLI VERSION 2023 12 1  RUN apt update          apt install  y wget unzip          wget https   github com bitwarden clients releases download cli v  BW CLI VERSION  bw linux   BW CLI VERSION  zip          unzip bw linux   BW CLI VERSION  zip          chmod  x bw          mv bw  usr local bin bw          rm  rfv   zip  COPY entrypoint sh    CMD    entrypoint sh        And the content of  entrypoint sh      bash    bin bash  set  e  bw config server   BW HOST   export BW SESSION   bw login   BW USER    passwordenv BW PASSWORD   raw   bw unlock   check  echo  Running  bw server  on port 8087  bw serve   hostname 0 0 0 0    disable origin protection         Deploy Bitwarden credentials     yaml    include  bitwarden cli secrets yaml             Deploy Bitwarden CLI container     yaml    include  bitwarden cli deployment yaml            NOTE  Deploying a network policy is recommended since there is no authentication to query the Bitwarden CLI  which means that your secrets are exposed     NOTE  In this example the Liveness probe is querying  sync to ensure that the Bitwarden CLI is able to connect to the server and is also synchronised   The secret sync is only every 2 minutes in this example      Deploy  Cluster SecretStores  There are four possible  Cluster SecretStores to deploy  each can access different types of fields from an item in the Bitwarden vault  It is not required to deploy them all      yaml    include  bitwarden secret store yaml             Usage   Cluster SecretStores      bitwarden login   Use to get the  username  or  password  fields    bitwarden fields   Use to get custom fields    bitwarden notes   Use to get notes    bitwarden attachments   Use to get attachments  remoteRef      key   ID of a secret  which can be found in the URL  itemId  parameter     https   myvault com   vault type login itemId                                      s     property   Name of the field to access        username  for the username of a secret   bitwarden login  SecretStore         password  for the password of a secret   bitwarden login  SecretStore         name of the custom field  for any custom field   bitwarden fields  SecretStore         id or name of the attachment  for any attachment   bitwarden attachment   SecretStore      yaml    include  bitwarden secret yaml


external secrets Metrics hide toc If you are using a different monitoring tool that also needs a endpoint you can set the Helm flag to In addition you can also set and to scrape the other components The External Secrets Operator exposes its Prometheus metrics in the path To enable it set the Helm flag to

Answer:
---
hide:
  - toc
---

# Metrics

The External Secrets Operator exposes its Prometheus metrics in the `/metrics` path. To enable it, set the `serviceMonitor.enabled` Helm flag to `true`.

If you are using a different monitoring tool that also needs a `/metrics` endpoint, you can set the `metrics.service.enabled` Helm flag to `true`. In addition you can also set `webhook.metrics.service.enabled` and `certController.metrics.service.enabled` to scrape the other components.

The Operator has [the controller-runtime metrics inherited from kubebuilder](https://book.kubebuilder.io/reference/metrics-reference.html) plus some custom metrics with a resource name prefix, such as `externalsecret_`.

## Cluster External Secret Metrics
| Name                                       | Type  | Description                                                |
|--------------------------------------------|-------|------------------------------------------------------------|
| `clusterexternalsecret_status_condition`   | Gauge | The status condition of a specific Cluster External Secret |
| `clusterexternalsecret_reconcile_duration` | Gauge | The duration time to reconcile the Cluster External Secret |

## External Secret Metrics
| Name                                           | Type      | Description                                                                                |
|------------------------------------------------|-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `externalsecret_provider_api_calls_count`      | Counter   | Number of API calls made to an upstream secret provider API. The metric provides a `provider`, `call` and `status` labels.                                                                                |
| `externalsecret_sync_calls_total`              | Counter   | Total number of the External Secret sync calls                                                                                |
| `externalsecret_sync_calls_error`              | Counter   | Total number of the External Secret sync errors                                                                                |
| `externalsecret_status_condition`              | Gauge     | The status condition of a specific External Secret                                                                                |
| `externalsecret_reconcile_duration`            | Gauge     | The duration time to reconcile the External Secret                                                                                |

## Cluster Secret Store Metrics
| Name                                    | Type  | Description                                             |
|-----------------------------------------|-------|---------------------------------------------------------|
| `clustersecretstore_status_condition`   | Gauge | The status condition of a specific Cluster Secret Store |
| `clustersecretstore_reconcile_duration` | Gauge | The duration time to reconcile the Cluster Secret Store |

# Secret Store Metrics
| Name                             | Type  | Description                                     |
|----------------------------------|-------|-------------------------------------------------|
| `secretstore_status_condition`   | Gauge | The status condition of a specific Secret Store |
| `secretstore_reconcile_duration` | Gauge | The duration time to reconcile the Secret Store |

## Controller Runtime Metrics
See [the kubebuilder documentation](https://book.kubebuilder.io/reference/metrics-reference.html) on the default exported metrics by controller-runtime.

## Dashboard

We provide a [Grafana Dashboard](https://raw.githubusercontent.com/external-secrets/external-secrets/main/docs/snippets/dashboard.json) that gives you an overview of External Secrets Operator:

![ESO Dashboard](../pictures/eso-dashboard-1.png)
![ESO Dashboard](../pictures/eso-dashboard-2.png)

## Service Level Indicators and Alerts

We find the following Service Level Indicators (SLIs) useful when operating ESO. They should give you a good starting point and hints to develop your own Service Level Objectives (SLOs).

#### Webhook HTTP Status Codes
The webhook HTTP status code indicates that a HTTP Request was answered successfully or not.
If the Webhook pod is not able to serve the requests properly then that failure may cascade down to the controller or any other user of `kube-apiserver`.

SLI Example: request error percentage.
```
sum(increase(controller_runtime_webhook_requests_total{service=~"external-secrets.*",code="500"}[1m]))
/
sum(increase(controller_runtime_webhook_requests_total{service=~"external-secrets.*"}[1m]))
```

#### Webhook HTTP Request Latency
If the webhook server is not able to respond in time then that may cause a timeout at the client.
This failure may cascade down to the controller or any other user of `kube-apiserver`.

SLI Example: p99 across all webhook requests.
```
histogram_quantile(0.99,
  sum(rate(controller_runtime_webhook_latency_seconds_bucket{service=~"external-secrets.*"}[5m])) by (le)
)
```

#### Controller Workqueue Depth
If the workqueue depth is > 0 for a longer period of time then this is an indicator for the controller not being able to reconcile resources in time. I.e. delivery of secret updates is delayed.

Note: when a controller is restarted, then `queue length = total number of resources`. Make sure to measure the time it takes for the controller to fully reconcile all secrets after a restart. In large clusters this may take a while, make sure to define an acceptable timeframe to fully reconcile all resources.

```
sum(
  workqueue_depth{service=~"external-secrets.*"}
) by (name)
```

#### Controller Reconcile Latency
The controller should be able to reconcile resources within a reasonable timeframe. When latency is high secret delivery may impacted.

SLI Example: p99 across all controllers.
```
histogram_quantile(0.99,
  sum(rate(controller_runtime_reconcile_time_seconds_bucket{service=~"external-secrets.*"}[5m])) by (le)
)
```

#### Controller Reconcile Error
The controller should be able to reconcile resources without errors. When errors occurr secret delivery may be impacted which could cascade down to the secret consuming applications.

```
sum(increase(
  controller_runtime_reconcile_total{service=~"external-secrets.*",controller=~"$controller",result="error"}[1m])
) by (result)
```

hide      toc        Metrics  The External Secrets Operator exposes its Prometheus metrics in the   metrics  path  To enable it  set the  serviceMonitor enabled  Helm flag to  true    If you are using a different monitoring tool that also needs a   metrics  endpoint  you can set the  metrics service enabled  Helm flag to  true   In addition you can also set  webhook metrics service enabled  and  certController metrics service enabled  to scrape the other components   The Operator has  the controller runtime metrics inherited from kubebuilder  https   book kubebuilder io reference metrics reference html  plus some custom metrics with a resource name prefix  such as  externalsecret        Cluster External Secret Metrics   Name                                         Type    Description                                                                                clusterexternalsecret status condition      Gauge   The status condition of a specific Cluster External Secret      clusterexternalsecret reconcile duration    Gauge   The duration time to reconcile the Cluster External Secret       External Secret Metrics   Name                                             Type        Description                                                                                externalsecret provider api calls count         Counter     Number of API calls made to an upstream secret provider API  The metric provides a  provider    call  and  status  labels                                                                                externalsecret sync calls total                 Counter     Total number of the External Secret sync calls                                                                                externalsecret sync calls error                 Counter     Total number of the External Secret sync errors                                                                                externalsecret status condition                 Gauge       The status condition of a specific External Secret                                                                                externalsecret reconcile duration               Gauge       The duration time to reconcile the External Secret                                                                                Cluster Secret Store Metrics   Name                                      Type    Description                                                                                clustersecretstore status condition      Gauge   The status condition of a specific Cluster Secret Store      clustersecretstore reconcile duration    Gauge   The duration time to reconcile the Cluster Secret Store      Secret Store Metrics   Name                               Type    Description                                                                                secretstore status condition      Gauge   The status condition of a specific Secret Store      secretstore reconcile duration    Gauge   The duration time to reconcile the Secret Store       Controller Runtime Metrics See  the kubebuilder documentation  https   book kubebuilder io reference metrics reference html  on the default exported metrics by controller runtime      Dashboard  We provide a  Grafana Dashboard  https   raw githubusercontent com external secrets external secrets main docs snippets dashboard json  that gives you an overview of External Secrets Operator     ESO Dashboard     pictures eso dashboard 1 png    ESO Dashboard     pictures eso dashboard 2 png       Service Level Indicators and Alerts  We find the following Service Level Indicators  SLIs  useful when operating ESO  They should give you a good starting point and hints to develop your own Service Level Objectives  SLOs         Webhook HTTP Status Codes The webhook HTTP status code indicates that a HTTP Request was answered successfully or not  If the Webhook pod is not able to serve the requests properly then that failure may cascade down to the controller or any other user of  kube apiserver    SLI Example  request error percentage      sum increase controller runtime webhook requests total service   external secrets    code  500   1m      sum increase controller runtime webhook requests total service   external secrets     1m              Webhook HTTP Request Latency If the webhook server is not able to respond in time then that may cause a timeout at the client  This failure may cascade down to the controller or any other user of  kube apiserver    SLI Example  p99 across all webhook requests      histogram quantile 0 99    sum rate controller runtime webhook latency seconds bucket service   external secrets     5m    by  le              Controller Workqueue Depth If the workqueue depth is   0 for a longer period of time then this is an indicator for the controller not being able to reconcile resources in time  I e  delivery of secret updates is delayed   Note  when a controller is restarted  then  queue length   total number of resources   Make sure to measure the time it takes for the controller to fully reconcile all secrets after a restart  In large clusters this may take a while  make sure to define an acceptable timeframe to fully reconcile all resources       sum    workqueue depth service   external secrets       by  name            Controller Reconcile Latency The controller should be able to reconcile resources within a reasonable timeframe  When latency is high secret delivery may impacted   SLI Example  p99 across all controllers      histogram quantile 0 99    sum rate controller runtime reconcile time seconds bucket service   external secrets     5m    by  le              Controller Reconcile Error The controller should be able to reconcile resources without errors  When errors occurr secret delivery may be impacted which could cascade down to the secret consuming applications       sum increase    controller runtime reconcile total service   external secrets    controller    controller  result  error   1m     by  result