@konfig.ts/external-secrets

@konfig.ts/external-secrets is the secret backend for the External Secrets operator. Instead of putting secret values in a manifest, it emits an ExternalSecret custom resource that names where each value lives in an external store (AWS Secrets Manager, GCP Secret Manager, Vault, 1Password, and similar). The operator running in the cluster reads those values and reconciles them into a normal Kubernetes Secret. konfig never sees the values: the backend declares that it needs no plaintext source (requiresSource: false), so nothing has to be decrypted at render time.

Install

bun add @konfig.ts/external-secrets

Usage

Bind a contract from @konfig.ts/env to the backend. The remoteRef function maps each key of the contract to its path in the external store.

import { ExternalSecrets } from "@konfig.ts/external-secrets"
import { Secret } from "@konfig.ts/k8s"

const dbCreds = Secret.define({
  name: "db-creds",
  namespace: "prod",
  env: { url: "DATABASE_URL", password: "DATABASE_PASSWORD" }
})

const bound = Secret.bind({
  secret: dbCreds,
  backend: ExternalSecrets.backend({
    secretStoreRef: { name: "aws-prod", kind: "ClusterSecretStore" },
    refreshInterval: "1h",
    remoteRef: (key) => ({ key: `prod/api/${key}` })
  })
})
// bound.manifest is the Manifest that renders to the ExternalSecret CR

To bind a whole environment bundle instead of a single secret, pass the same backend to Environment.bind({ env, namespace, secrets: { db: { backend } } }). Because this backend needs no plaintext, no source field is required.

Surface

Export	Purpose
`ExternalSecrets.backend`	`(opts)`: a `SecretBackend<N, K, false, ExternalSecret>`
`ExternalSecretsBackendOptions<K>`	`secretStoreRef` (required), `refreshInterval?` (typed as `${number}${"s" \| "m" \| "h"}`, for example `"1h"`), `remoteRef?: (key: K) => ExternalSecretRemoteRef`, `target?: ExternalSecretTarget`
`SecretStoreRef`, `SecretStoreKind`	`{ name, kind?: "SecretStore" \| "ClusterSecretStore" }`
`ExternalSecret`, `ExternalSecretSpec`, `ExternalSecretDataEntry`, `ExternalSecretRemoteRef`, `ExternalSecretTarget`, `ExternalSecretCreationPolicy`, `ExternalSecretDeletionPolicy`	CR types (`apiVersion: external-secrets.io/v1`); `ExternalSecretRemoteRef` is `{ key, property?, version?, conversionStrategy?, decodingStrategy? }`

Errors

This package exports no tagged error classes. It performs no I/O of its own, so the only failures you can hit at bind time come from the shared machinery in @konfig.ts/k8s and @konfig.ts/env.

Requirements

effect@^4.0.0-rc.111 as a peer dependency (Effect 4, release-candidate line).
Depends on @konfig.ts/core and @konfig.ts/k8s.
Runtime: Bun recommended; Node >= 23.6 works; Node 22.6 to 23.5 with --experimental-strip-types; tsx works.

Source and README: packages/external-secrets.