---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: webhook-backend
spec:
  provider:
    webhook:
      url: "http://httpbin.org/push?id={{ .remoteRef.remoteKey }}&secret={{ .remoteRef.secretKey }}"
      body: '{"secret-field": "{{ index .remoteRef .remoteRef.remoteKey }}"}'
      headers:
        Content-Type: application/json
        Authorization: Basic {{ print .auth.username ":" .auth.password | b64enc }}
      secrets:
      - name: auth
        secretRef:
          name: webhook-credentials
---
apiVersion: v1
kind: Secret
metadata:
  name: webhook-credentials
  labels:
    external-secrets.io/type: webhook #Needed to allow webhook to use this secret
data:
  username: dGVzdA== # "test"
  password: dGVzdA== # "test"
---
apiVersion: v1
kind: Secret
metadata:
  name: test-secret
stringData:
  testsecret: testsecret
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: pushsecret-example # Customisable
spec:
  refreshInterval: 1h # Refresh interval for which push secret will reconcile
  secretStoreRefs: # A list of secret stores to push secrets to
    - name: webhook-backend
      kind: SecretStore
  selector:
    secret:
      name: test-secret
  data:
    - conversionStrategy:
      match:
        secretKey: testsecret
        remoteRef:
          remoteKey: remotekey

---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  creationTimestamp: "2025-10-04T09:40:05Z"
  generation: 1
  name: webhook-backend
  namespace: default
  resourceVersion: "212110557"
  uid: 79da855f-dcd0-4551-ac41-e4da7df7e62e
spec:
  provider:
    webhook:
      body: '{"secret-field": "{{ index .remoteRef .remoteRef.remoteKey }}"}'
      headers:
        Authorization: Basic {{ print .auth.username ":" .auth.password | b64enc }}
        Content-Type: application/json
      result:
        jsonPath: $.args.parameter
      secrets:
      - name: auth
        secretRef:
          name: webhook-credentials
      url: http://httpbin.org/push?id={{ .remoteRef.remoteKey }}&secret={{ .remoteRef.secretKey
        }}
status:
  capabilities: ReadOnly
  conditions:
  - lastTransitionTime: "2025-10-04T09:40:05Z"
    message: store validated
    reason: Valid
    status: "True"
    type: Ready
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  creationTimestamp: "2025-10-04T09:41:07Z"
  generation: 1
  name: pushsecret-example
  namespace: default
  resourceVersion: "212111068"
  uid: fc82c9cd-3fc7-4857-8097-84a771f4d9f0
spec:
  data:
  - conversionStrategy: None
    match:
      remoteRef:
        remoteKey: remotekey
      secretKey: testsecret
  deletionPolicy: None
  refreshInterval: 1h
  secretStoreRefs:
  - kind: SecretStore
    name: webhook-backend
  selector:
    secret:
      name: test-secret
  updatePolicy: Replace
status:
  conditions:
  - lastTransitionTime: "2025-10-04T09:41:07Z"
    message: 'set secret failed: could not write remote ref testsecret to target secretstore
      webhook-backend: failed to push webhook data: failed to push webhook data: Secret
      does not exist'
    reason: Errored
    status: "False"
    type: Ready
  syncedPushSecrets:
    SecretStore/webhook-backend: {}
---
apiVersion: v1
data:
  testsecret: dGVzdHNlY3JldA==
kind: Secret
metadata:
  creationTimestamp: "2025-10-04T09:34:35Z"
  name: test-secret
  namespace: default
  resourceVersion: "212107898"
  uid: 820751da-b5a6-40bd-88f8-5b3c8f672065
type: Opaque