^{Originally posted by MatteoJoliveau June 17, 2021}
Hello community!
We're using the old kubernetes-external-secrets controller and are in the verge of migrating to this new implementation that we already like very much.

One feature that I think would be very useful to reduce manual intervention is secrets generation, that is the ability for external-secrets to generate a secret string (e.g. a password) based on some parameters, store it in the backing SecretStore if the key does not exist yet or read it if it already does. There are a lot of secrets that can be generated on the fly and configured, some examples:

• key bases used to derive secret keys for cookie encryption, token signing, etc (e.g. Ruby on Rails SECRET_KEY_BASE variable)
• self-configured user credentials. Some Kubernetes operators, like the MongoDB Community Operator require to inject a password from the outside instead of generating one themselves, which reduces the ability to automatically and declaratively manage deployment of those components if we need to generate and store the password in Vault ourselves.
• shared secrets used for symmetric encryption/signing. Although inferior compared to public key encryption, there are cases where we need to support such encyprtion, and having the secret automatically generated for us on first deployment would be awesome.

Bonus round: external-secrets could also rotate the secrets it generates following some provided configuration to increase security.

Example API implementation:

apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: example-secret
spec:
  secretStoreRef:
    name: example-secret-store
    kind: SecretStore
  refreshInterval: "1h"
  target:
    name: example-secret
    creationPolicy: 'Owner'
  data:
    - secretKey: secret-key-base
      remoteRef:
        key: path/to/my/secret
        # This property does not exist in the SecretStore until first deployment of this ExternalSecret
        property: secret-key-base
        generator:
          # Generate a random string
          string:
            length: 16
            useSpecialCharacters: false

Feedbacks are most welcome on this proposal!