config.json

{
  "description": "External secrets plugin for Docker Swarm",
  "documentation": "https://docs.docker.com/engine/extend/",
  "interface": {
    "types": ["docker.secretdriver/1.0", "docker.secretprovider/1.0"],
    "socket": "plugin.sock"
  },
  "entrypoint": ["./swarm-external-secrets"],
  "workdir": "/root",
  "linux": {
    "capabilities": ["CAP_SYS_ADMIN"]
  },
  "network": {
    "type": "host"
  },
  "mounts": [
    {
      "source": "/var/run/docker.sock",
      "destination": "/var/run/docker.sock",
      "type": "bind",
      "options": ["bind", "rbind"]
    },
    {
      "source": "/run/swarm-external-secrets",
      "destination": "/run/swarm-external-secrets",
      "type": "bind",
      "options": ["bind", "rbind", "rshared"]
    }
  ],
  "env": [
    {
      "name": "VAULT_ADDR",
      "description": "Vault server address",
      "settable": ["value"]
    },
    {
      "name": "VAULT_AUTH_METHOD",
      "description": "Vault authentication method",
      "settable": ["value"]
    },
    {
      "name": "VAULT_TOKEN",
      "description": "Vault authentication token",
      "settable": ["value"]
    },
    {
      "name": "VAULT_ROLE_ID",
      "description": "Vault AppRole role ID",
      "settable": ["value"]
    },
    {
      "name": "VAULT_SECRET_ID",
      "description": "Vault AppRole secret ID",
      "settable": ["value"]
    },
    {
      "name": "VAULT_APPROLE_AUTH_PATH",
      "description": "Vault AppRole auth mount path",
      "settable": ["value"]
    },
    {
      "name": "VAULT_JWT_ROLE",
      "description": "Vault JWT auth role",
      "settable": ["value"]
    },
    {
      "name": "VAULT_JWT",
      "description": "Vault JWT auth token",
      "settable": ["value"]
    },
    {
      "name": "VAULT_JWT_FILE",
      "description": "Path to a Vault JWT auth token file",
      "settable": ["value"]
    },
    {
      "name": "VAULT_JWT_AUTH_PATH",
      "description": "Vault JWT auth mount path",
      "settable": ["value"]
    },
    {
      "name": "VAULT_MOUNT_PATH",
      "description": "Vault mount path",
      "settable": ["value"]
    },
    {
      "name": "SECRETS_PROVIDER",
      "description": "Secrets provider type (e.g., vault, aws, azure, openbao, oci)",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_ADDR",
      "description": "OpenBao server address",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_AUTH_METHOD",
      "description": "OpenBao authentication method",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_ROLE_ID",
      "description": "OpenBao AppRole role ID",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_SECRET_ID",
      "description": "OpenBao AppRole secret ID",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_APPROLE_AUTH_PATH",
      "description": "OpenBao AppRole auth mount path",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_JWT_ROLE",
      "description": "OpenBao JWT auth role",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_JWT",
      "description": "OpenBao JWT auth token",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_JWT_FILE",
      "description": "Path to an OpenBao JWT auth token file",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_JWT_AUTH_PATH",
      "description": "OpenBao JWT auth mount path",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_AUTH_METHOD",
      "description": "OpenBao authentication method",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_TOKEN",
      "description": "OpenBao authentication token",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_MOUNT_PATH",
      "description": "OpenBao mount path",
      "settable": ["value"]
    },
    {
      "name": "ENABLE_ROTATION",
      "description": "Enable automatic secret rotation (true/false)",
      "settable": ["value"]
    },
    {
      "name": "ROTATION_INTERVAL",
      "description": "Secret rotation check interval (e.g., 5m, 1h)",
      "settable": ["value"]
    },
    {
      "name": "AWS_REGION",
      "description": "AWS region",
      "settable": ["value"]
    },
    {
      "name": "AWS_ACCESS_KEY_ID",
      "description": "AWS access key ID",
      "settable": ["value"]
    },
    {
      "name": "AWS_SECRET_ACCESS_KEY",
      "description": "AWS secret access key",
      "settable": ["value"]
    },
    {
      "name": "AWS_ENDPOINT_URL",
      "description": "AWS endpoint URL (e.g. for LocalStack)",
      "settable": ["value"]
    },
    {
      "name": "AWS_KMS_ENDPOINT",
      "description": "AWS KMS endpoint URL (optional override, e.g. for LocalStack)",
      "settable": ["value"]
    },
    {
      "name": "AZURE_VAULT_URL",
      "description": "Azure Key Vault URL",
      "settable": ["value"]
    },
    {
      "name": "AZURE_CLIENT_ID",
      "description": "Azure client ID",
      "settable": ["value"]
    },
    {
      "name": "AZURE_CLIENT_SECRET",
      "description": "Azure client secret",
      "settable": ["value"]
    },
    {
      "name": "AZURE_TENANT_ID",
      "description": "Azure tenant ID",
      "settable": ["value"]
    },
    {
      "name": "AZURE_ACCESS_TOKEN",
      "description": "Azure access token for Key Vault",
      "settable": ["value"]
    },
    {
      "name": "AZURE_INSECURE_HTTP",
      "description": "Allow HTTP connections to Azure Key Vault (for local emulators like floci-az)",
      "settable": ["value"]
    },
    {
      "name": "AZURE_AUTHORITY_HOST",
      "description": "Azure authority host URL (for local emulators like floci-az)",
      "settable": ["value"]
    },
    {
      "name": "GCP_PROJECT_ID",
      "description": "GCP project ID",
      "settable": ["value"]
    },
    {
      "name": "GOOGLE_APPLICATION_CREDENTIALS",
      "description": "Google application credentials required for GCP Secrets manager",
      "settable": ["value"]
    },
    {
      "name": "GCP_CREDENTIALS_JSON",
      "description": "Google credentials json required for GCP Secrets manager",
      "settable": ["value"]
    },
    {
      "name": "SECRET_MANAGER_EMULATOR_HOST",
      "description": "GCP Secret Manager emulator host:port (floci-gcp, e.g. localhost:4588)",
      "settable": ["value"]
    },
    {
      "name": "GCP_ENDPOINT",
      "description": "Optional GCP Secret Manager endpoint override (alias for SECRET_MANAGER_EMULATOR_HOST)",
      "settable": ["value"]
    },
    {
      "name": "OCI_REGION",
      "description": "OCI region",
      "settable": ["value"]
    },
    {
      "name": "OCI_TENANCY_OCID",
      "description": "OCI tenancy OCID",
      "settable": ["value"]
    },
    {
      "name": "OCI_USER_OCID",
      "description": "OCI user OCID",
      "settable": ["value"]
    },
    {
      "name": "OCI_FINGERPRINT",
      "description": "OCI API key fingerprint",
      "settable": ["value"]
    },
    {
      "name": "OCI_PRIVATE_KEY",
      "description": "OCI private key (base64-encoded PEM)",
      "settable": ["value"]
    },
    {
      "name": "OCI_PRIVATE_KEY_PASSPHRASE",
      "description": "OCI private key passphrase",
      "settable": ["value"]
    },
    {
      "name": "OCI_VAULT_OCID",
      "description": "OCI Vault OCID",
      "settable": ["value"]
    },
    {
      "name": "OCI_AUTH_METHOD",
      "description": "OCI authentication method (api_key, instance_principal)",
      "settable": ["value"]
    },
    {
      "name": "OCI_ENDPOINT",
      "description": "OCI API endpoint override (e.g. floci-oci http://localhost:4599)",
      "settable": ["value"]
    },
    {
      "name": "ENABLE_MONITORING",
      "description": "Enable Monitoring secret rotation (true/false) default true",
      "settable": ["value"]
    },
    {
      "name": "MONITORING_PORT",
      "description": "default 8080",
      "settable": ["value"]
    },
    {
      "name": "PLUGIN_LOG_PATH",
      "description": "Path for plugin file logs (default /run/swarm-external-secrets/plugin.log)",
      "settable": ["value"]
    },
    {
      "name": "LOG_LEVEL",
      "description": "Log level (debug, info, warn, error), default info",
      "settable": ["value"]
    },
    {
      "name": "uid",
      "description": "User ID to run the plugin as",
      "settable": ["value"]
    },
    {
      "name": "gid",
      "description": "Group ID to run the plugin as",
      "settable": ["value"]
    },
    {
      "name": "VAULT_SKIP_VERIFY",
      "description": "Skip TLS certificate verification for Vault (true/false)",
      "settable": ["value"]
    },
    {
      "name": "OPENBAO_SKIP_VERIFY",
      "description": "Skip TLS certificate verification for OpenBao (true/false)",
      "settable": ["value"]
    }
  ]
}