External Secrets Operator: Sync Vault, AWS, and Azure Secrets to Kubernetes

The Secret Management Problem

Kubernetes Secrets are base64-encoded (not encrypted) and stored in etcd. In production you need:

• Secrets managed in a central vault (Vault, AWS SM, Azure KV)
• Automatic rotation without redeployment
• Audit trail of who accessed what
• No secrets in Git, ever

External Secrets Operator (ESO) syncs secrets from external stores into Kubernetes.

Architecture

┌──────────────────────────────────────────────────┐
│              Kubernetes Cluster                   │
│                                                  │
│  ┌──────────────────────────────────────────┐   │
│  │    External Secrets Operator              │   │
│  └───────────────────┬──────────────────────┘   │
│                      │                           │
│  ┌───────────────────▼──────────────────────┐   │
│  │         ExternalSecret CRD                │   │
│  │  (defines what to fetch and where)        │   │
│  └───────────────────┬──────────────────────┘   │
│                      │ sync                      │
│  ┌───────────────────▼──────────────────────┐   │
│  │         Kubernetes Secret                 │   │
│  │     (auto-created and refreshed)          │   │
│  └──────────────────────────────────────────┘   │
└──────────────────────────────────────────────────┘
        │              │              │
        ▼              ▼              ▼
┌──────────────┐ ┌──────────┐ ┌────────────┐
│ HashiCorp    │ │   AWS    │ │   Azure    │
│    Vault     │ │ Secrets  │ │  Key Vault │
└──────────────┘ └──────────┘ └────────────┘

Installation

helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace

Provider Configuration

AWS Secrets Manager

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secrets
  namespace: production
spec:
  provider:
    aws:
      service: SecretsManager
      region: eu-west-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa  # IRSA

HashiCorp Vault

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: "https://vault.example.com"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "external-secrets"

Azure Key Vault

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: azure-kv
spec:
  provider:
    azurekv:
      vaultUrl: "https://my-keyvault.vault.azure.net"
      authType: WorkloadIdentity
      serviceAccountRef:
        name: external-secrets-sa

Fetch Secrets

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: production
spec:
  refreshInterval: 1h  # Re-sync every hour (catches rotations)
  secretStoreRef:
    name: aws-secrets
    kind: SecretStore
  target:
    name: db-credentials  # K8s Secret name
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: production/database
        property: username
    - secretKey: password
      remoteRef:
        key: production/database
        property: password
    - secretKey: host
      remoteRef:
        key: production/database
        property: host

This creates a Kubernetes Secret db-credentials with keys username, password, host — automatically refreshed every hour.

Use in Pods

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials  # Created by ESO
                  key: password

Secret Rotation

When the source secret rotates (e.g., AWS auto-rotation every 30 days):

1. ESO detects change on next refreshInterval
2. Updates Kubernetes Secret
3. Pods with envFrom need restart (use Reloader or Stakater)

# Auto-restart pods when secret changes
metadata:
  annotations:
    secret.reloader.stakater.com/reload: "db-credentials"

Supported Providers

Related Articles

• Cilium: eBPF Security
• Harbor: Container Registry
• Velero: K8s Backup