To find out if this integration is available in your organization, see your Datadog Integrations page or ask your organization administrator.
To initiate an exception request to enable this integration for your organization, email support@ddog-gov.com.
Overview
The External Secrets Operator (ESO) synchronizes secrets from external providers, such as HashiCorp Vault or AWS Secrets Manager, into Kubernetes Secrets. This integration provides visibility into ESO’s health and performance, including reconciliation rates, provider API calls, secret sync status, and controller runtime metrics.
Setup
Installation
If you are using Agent v6.8+ follow the instructions below to install the External Secrets check on your host. See the dedicated Agent guide for installing community integrations to install checks with the Agent Manager or in a Docker environment.
Download and launch the Datadog Agent.
Run the following command to install the Agent integration:
datadog-agent integration install -t datadog-external-secrets==<INTEGRATION_VERSION>
Configure your integration in the same way as core integrations.
Configuration
Edit the external_secrets.d/conf.yaml file in the conf.d/ folder at the root of your Agent’s configuration directory to start collecting your External Secrets Operator metrics. See the sample external_secrets.d/conf.yaml for all available configuration options.
Restart the Agent.
Validation
Run the Agent’s status subcommand and look for external_secrets under the Checks section.
Data Collected
Metrics
| |
|---|
external_secrets.externalsecret.status_condition
(gauge) | The status condition of a specific External Secret. |
external_secrets.externalsecret.reconcile_duration
(gauge) | The duration time to reconcile the External Secret.
Shown as millisecond |
external_secrets.externalsecret.sync_calls.count
(count) | Total number of the External Secret sync calls. |
external_secrets.externalsecret.sync_calls_error.count
(count) | Total number of the External Secret sync errors. |
external_secrets.externalsecret.provider_api_calls.count
(count) | Number of API calls made to an upstream secret provider API. |
external_secrets.clusterexternalsecret.status_condition
(gauge) | The status condition of a specific Cluster External Secret. |
external_secrets.clusterexternalsecret.reconcile_duration
(gauge) | The duration time to reconcile the Cluster External Secret.
Shown as millisecond |
external_secrets.pushsecret.status_condition
(gauge) | The status condition of a specific Push Secret. |
external_secrets.pushsecret.reconcile_duration
(gauge) | The duration time to reconcile the Push Secret.
Shown as millisecond |
external_secrets.clustersecretstore.status_condition
(gauge) | The status condition of a specific Cluster Secret Store. |
external_secrets.clustersecretstore.reconcile_duration
(gauge) | The duration time to reconcile the Cluster Secret Store.
Shown as millisecond |
external_secrets.secretstore.status_condition
(gauge) | The status condition of a specific Secret Store. |
external_secrets.secretstore.reconcile_duration
(gauge) | The duration time to reconcile the Secret Store.
Shown as millisecond |
external_secrets.controller_runtime.reconcile.count
(count) | Total number of reconciliations per controller. |
external_secrets.controller_runtime.reconcile_errors.count
(count) | Total number of reconciliation errors per controller. |
external_secrets.controller_runtime.reconcile_time_seconds.count
(count) | Number of reconciliation duration observations.
Shown as second |
external_secrets.controller_runtime.reconcile_time_seconds.sum
(count) | Sum of reconciliation durations.
Shown as second |
external_secrets.controller_runtime.reconcile_time_seconds.bucket
(count) | Histogram buckets of reconciliation durations.
Shown as second |
external_secrets.controller_runtime.active_workers
(gauge) | Number of currently used workers per controller. |
external_secrets.controller_runtime.max_concurrent_reconciles
(gauge) | Maximum number of concurrent reconciles per controller. |
external_secrets.workqueue.depth
(gauge) | Current depth of the workqueue. |
Service Checks
external_secrets.openmetrics.health
Returns CRITICAL if the Agent is unable to connect to the External Secrets Operator OpenMetrics endpoint, otherwise returns OK.
Statuses: ok, critical
Events
The External Secrets integration does not include any events.
Troubleshooting
Need help? Contact Datadog support.
Further Reading
Additional helpful documentation, links, and articles:
