Bitwarden Password Manager ESO

A Helm chart that deploys a Bitwarden CLI bridge and integrates it with the External Secrets Operator via ClusterSecretStore, allowing you to sync secrets from your Bitwarden vault directly into Kubernetes.

Architecture

Bitwarden Vault
      │
      ▼
Bitwarden CLI Pod (port 8087)
      │
      ▼
ClusterSecretStore (ESO Webhook Provider)
      │
      ▼
ExternalSecret → Kubernetes Secret

1. Bitwarden CLI Pod — runs the CLI in serve mode, exposing a local REST API on port 8087.
2. Kubernetes Service — provides a stable in-cluster endpoint for the CLI pod.
3. ClusterSecretStore — configured as a Webhook provider that queries the CLI API.
4. External Secrets Operator — orchestrates syncing from Bitwarden into Kubernetes Secrets.

Prerequisites

• External Secrets Operator installed in your cluster.
• A Bitwarden account with API access enabled.

Installation

helm repo add bitwarden-password-manager-eso https://user-cube.github.io/bitwarden-password-manager-eso
helm repo update

For SOPS-encrypted credentials (recommended):

helm secrets install bitwarden-password-manager-eso bitwarden-password-manager-eso/bitwarden-password-manager-eso -f values.yaml -f secrets.enc.yaml

Default ClusterSecretStores

Store	JSONPath	Use case
bitwarden-login	$.data.login.username	Usernames
bitwarden-password	$.data.login.password	Passwords
bitwarden-fields	$.data.fields	Custom fields
bitwarden-notes	$.data.notes	Secure notes
bitwarden-attachments	$.data.attachments	Attachments

Example ExternalSecret

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-app-credentials
spec:
  refreshInterval: "1h"
  secretStoreRef:
    name: bitwarden-password
    kind: ClusterSecretStore
  target:
    name: my-app-k8s-secret
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: "your-bitwarden-item-uuid"

The remoteRef.key is the UUID of the item in your Bitwarden vault (visible in the web vault URL).

Documentation

Full documentation is available at the project docs site:

• Getting Started
• Usage Guide
• SOPS Secrets
• Configuration
• Development

Helm Chart Reference

For the full values reference see the chart README or ArtifactHub.

License

Apache 2.0