gistfile1.txt

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: cyberark-ccp
spec:
  provider:
    webhook:
      url: "https://ccp.example.com/AIMWebService/api/Accounts\
            ?AppID=MyApp\
            &Safe=MySafe\
            &Object={{ .remoteRef.key }}"
      method: GET
      result:
        jsonPath: "$.Content"       # CCP returns the password in this field
      caBundle: "..."               # Base64 PEM CA cert if CCP uses internal TLS
      # CCP can use client cert auth instead of a token
      secrets:
        - name: client-cert
          secretRef:
            name: ccp-client-cert
            key: tls.crt
        - name: client-key
          secretRef:
            name: ccp-client-cert
            key: tls.key