--- title: Installing the External Secrets Operator for Red Hat OpenShift --- # Installing the External Secrets Operator for Red Hat OpenShift {#external-secrets-operator-install} The External Secrets Operator for Red Hat OpenShift is not installed on the OpenShift Container Platform by default. Install the External Secrets Operator by using either the web console or the command-line interface (CLI). ## Limitations of External Secrets Operator for Red Hat OpenShift {#external-secrets-operator-limitations_external-secrets-operator-install} There are specific operational constraints to consider when deploying or removing the External Secrets Operator for Red Hat OpenShift, that might require manual intervention or strict dependency ordering. The following are the limitations of External Secrets Operator for Red Hat OpenShift during the installation and uninstallation of the `external-secrets` application. - Uninstalling the External Secrets Operator for Red Hat OpenShift does not delete the resources created for `external-secrets` application. you must clean up the resources manually. - When you add `cert-manager` Operator configurations in `externalsecrets.operator.openshift.io` object after creation, delete the `external-secrets-cert-controller` deployment resource manually to prevent degradation of the `external-secrets` application. - Enable the `BitwardenSecretManagerProvider` field in `externalsecrets.operator.openshift.io` object only when installed on OpenShift Cluster running on x86_64 and arm64 architectures . - Ensure `cert-manager` Operator is installed and operational before deploying the External Secrets Operator for Red Hat OpenShift for seamless functioning. If you install the `cert-manager` Operator later, manually restart the `external-secrets-operator` pod to apply cert-manager configurations in `externalsecrets.operator.openshift.io` object. ## Installing the External Secrets Operator for Red Hat OpenShift by using the web console {#external-secrets-operator-install-console_external-secrets-operator-install} You can install the External Secrets Operator for Red Hat OpenShift by using the OpenShift Container Platform web console. You can select the desired update channel and approval strategy, and deploy the Operator into the recommended namespace without manually defining YAML resources. **Prerequisites** - You have access to the cluster with `cluster-admin` privileges. - You have access to the OpenShift Container Platform web console. **Procedure** 1. Log in to the OpenShift Container Platform web console. 2. Navigate to **Ecosystem** → **Software Catalog**. 3. Enter **External Secrets Operator** in the search box. 4. Select the **External Secrets Operator for Red Hat OpenShift** from the generated list and click **Install**. 5. On the **Install Operator** page: 1. Update the **Update channel**, if necessary. The channel defaults to **stable-v1**, which installs the latest stable release of the External Secrets Operator. 2. Select the version from **Version** drop-down list. 3. Choose the **Installed Namespace** for the Operator. - To use the default Operator namespace, select the **Operator recommended Namespace** option. - To use the namespace that you created, select the **Select a Namespace** option, and then select the namespace from the drop-down list. - If the default `external-secrets-operator` namespace does not exist, it is created for you by the Operator Lifecycle Manager (OLM). 4. Select an **Update approval** strategy. - The **Automatic** strategy enables OLM to automatically update the Operator when a new version is available. - The **Manual** strategy requires a user with appropriate credentials to approve the Operator update. 5. Click **Install**. **Verification** 1. Navigate to **Ecosystem** → **Installed Operators**. 2. Verify that **External Secrets Operator** is listed with a **Status** of **Succeeded** in the `external-secrets-operator` namespace. ## Installing the External Secrets Operator for Red Hat OpenShift by using the CLI {#external-secrets-operator-install-cli_external-secrets-operator-install} You can install the External Secrets Operator for Red Hat OpenShift by manually configuring the Operator Lifecycle Manager (OLM) resources using the OpenShift CLI. You can create a dedicated namespace, define the Operator’s scope, and install the Operator from the catalog. **Prerequisites** - You have access to the cluster with `cluster-admin` privileges. **Procedure** 1. Create a new project named `external-secrets-operator` by running the following command: ```terminal $ oc new-project external-secrets-operator ``` 2. Create an `OperatorGroup` object by defining a YAML file with the following content: ```yaml apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: openshift-external-secrets-operator namespace: external-secrets-operator spec: targetNamespaces: [] ``` 3. Create the `OperatorGroup` object by running the following command: ```terminal $ oc create -f operatorGroup.yaml ``` 4. Create a `Subscription` object by defining a YAML file with the following content: The following is an example of a `subscription.yaml` file. ```yaml apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: openshift-external-secrets-operator namespace: external-secrets-operator spec: channel: stable-v1 name: openshift-external-secrets-operator source: redhat-operators sourceNamespace: openshift-marketplace installPlanApproval: Automatic startingCSV: external-secrets-operator.v1.0.0 ``` 5. Create the `Subscription` object by running the following command: ```terminal $ oc create -f subscription.yaml ``` **Verification** 1. Verify that the OLM subscription is created by running the following command: ```terminal $ oc get subscription -n external-secrets-operator ``` The following is example output verifying the OLM subscription is created. ```terminal NAME PACKAGE SOURCE CHANNEL openshift-external-secrets-operator openshift-external-secrets-operator redhat-operators stable-v1 ``` 2. Verify whether the Operator is successfully installed by running the following command: ```terminal $ oc get csv -n external-secrets-operator ``` The following is example output verifying that the Operator is installed. ```terminal NAME DISPLAY VERSION REPLACES PHASE external-secrets-operator.v1.0.0 External Secrets Operator for Red Hat OpenShift 1.0.0 Succeeded ``` 3. Verify that the status of the External Secrets Operator is `Running` by entering the following command: ```terminal $ oc get pods -n external-secrets-operator ``` The following is example output verifying the External Secrets Operator is `Running`. ```terminal NAME READY STATUS RESTARTS AGE external-secrets-operator-controller-manager-5699f4bc54-kbsmn 1/1 Running 0 25h ``` **Additional resources** {._additional-resources} - [Adding Operators to a cluster](/openshift-docs-markdown/operators/admin/olm-adding-operators-to-cluster#olm-adding-operators-to-a-cluster) ## Installing the External Secrets operand by using the CLI {#external-secrets-operand-install-cli_external-secrets-operator-install} To install the External Secrets operand, create an instance of the `ExternalSecrets` custom resource by using the command-line interface (CLI) which deploys necessary operand components such as the core controller, webhook, and certificate controller into the `external-secrets` namespace. **Prerequisites** - You have access to the cluster with `cluster-admin` privileges. **Procedure** 1. Create an `externalsecretsconfig.openshift.operator.io` object by defining a YAML file with the following content: ```yaml {title="Example externalsecretsconfig.yaml file"} apiVersion: operator.openshift.io/v1alpha1 kind: ExternalSecretsConfig metadata: labels: app: external-secrets-operator app.kubernetes.io/name: cluster name: cluster spec: controllerConfig: networkPolicies: - componentName: ExternalSecretsCoreController egress: - {} name: allow-external-secrets-egress ``` For more information on spec configuration, see "External Secrets Operator for Red Hat OpenShift APIs". 2. Create the `externalsecretsconfigs.openshift.operator.io` object by running the following command: ```terminal $ oc create -f externalsecretsconfig.yaml ``` **Verification** 1. Verify that the `external-secrets` pods are running by entering the following command: ```terminal $ oc get pods -n external-secrets ``` ```terminal {title="Example output"} NAME READY STATUS RESTARTS AGE external-secrets-75d47cb9c8-6p4n2 1/1 Running 0 4h5m external-secrets-cert-controller-676444b897-qb6ft 1/1 Running 0 4h5m external-secrets-webhook-b566658ff-7m4d5 1/1 Running 0 4h5m ``` 2. Verify that the `external-secrets-operator` deployment object reports a successful status by running the following command: ```terminal $ oc get externalsecretsconfig.operator.openshift.io cluster -n external-secrets-operator -o jsonpath='{.status.conditions}' | jq . ``` ```terminal {title="Example output"} [ { "lastTransitionTime": "2025-06-17T14:57:04Z", "message": "", "observedGeneration": 2, "reason": "Ready", "status": "False", "type": "Degraded" }, { "lastTransitionTime": "2025-11-27T05:58:38Z, "message": "reconciliation successful", "observedGeneration": 2, "reason": "Ready", "status": "True", "type": "Ready" } ] ``` **Next step** - Configure the network policies of the operand as described in "Configuring network policy for the operand". ## Understanding update channels of the External Secrets Operator for Red Hat OpenShift {#external-secrets-operator-update-channels_external-secrets-operator-install} Control the version of the External Secrets Operator for Red Hat OpenShift in your cluster by selecting an update channel. By using this mechanism, you can declare a specific version track, ensuring your environment receives only the updates you require for stability. The External Secrets Operator for Red Hat OpenShift offers the following update channels: - `stable-v1` - `stable-v1.y` ### About the External Secrets Operator for Red Hat OpenShift stable-v1 channel {#external-secrets-operator-stablev1-channel_external-secrets-operator-install} Select the `stable-v1` channel to install and update the latest release of the External Secrets Operator for Red Hat OpenShift. By selecting this channel, you can use the most recent stable release for your Operator. > [!NOTE] > The `stable-v1` channel is the default and suggested channel while installing the External Secrets Operator for Red Hat OpenShift. The `stable-v1` channel offers the following update approval strategies: Automatic : If you choose automatic updates for an installed External Secrets Operator for Red Hat OpenShift, a new version of the External Secrets Operator for Red Hat OpenShift is available in the `stable-v1` channel. The Operator Lifecycle Manager (OLM) automatically upgrades the running instance of your Operator without human intervention. Manual : If you select manual updates, when a newer version of the External Secrets Operator for Red Hat OpenShift is available, OLM creates an update request. As a cluster administrator, you must then manually approve that update request to have the cert-manager Operator for Red Hat OpenShift updated to the new version. ### About the External Secrets Operator for Red Hat OpenShift stable-v1.y channel {#external-secrets-operator-stablev1-y-channel_external-secrets-operator-install} Select the stable-v1 channel to install and update the latest release of the External Secrets Operator for Red Hat OpenShift. By selecting this channel, you can use the latest stable release and allows you to choose between automatic and manual updates. The y-stream version of the External Secrets Operator for Red Hat OpenShift installs updates from the `stable-v1.y` channels such as `stable-v1.0`, `stable-v1.1`, and `stable-v1.2`. Select the `stable-v1.y` channel if you want to use the y-stream version and stay updated to the z-stream version of the External Secrets Operator for Red Hat OpenShift. The `stable-v1.y` channel offers the following update approval strategies: Automatic : If you choose automatic updates for an installed External Secrets Operator for Red Hat OpenShift, a new z-stream version of the External Secrets Operator for Red Hat OpenShift is available in the `stable-v1.y` channel. OLM automatically upgrades the running instance of your Operator without human intervention. Manual : If you select manual updates, when a newer version of the External Secrets Operator for Red Hat OpenShift is available, OLM creates an update request. As a cluster administrator, you must then manually approve that update request to have the External Secrets Operator for Red Hat OpenShift updated to the new version of the z-stream releases. **Additional resources** {._additional-resources} - [Adding Operators to a cluster](/openshift-docs-markdown/operators/admin/olm-adding-operators-to-cluster#olm-adding-operators-to-a-cluster) - [Updating installed Operators](/openshift-docs-markdown/operators/admin/olm-upgrading-operators#olm-upgrading-operators)