🔐 Vault secrets → Kubernetes (External Secrets)

Store secrets in Vault, sync to K8s Secrets with ESO — zero plain YAML in git. · ~35 min

Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04

If you're on Kubernetes 1.27 or older

  • Ingress: networking.k8s.io/v1 is required — v1beta1 removed in 1.22+
  • Pod Security: PodSecurityPolicy removed in 1.25 — use Pod Security Admission (PSA) labels
  • HPA v2 autoscaling/v2 is stable — check API version in manifests

If you're on Kubernetes 1.28

  • Sidecar containers (1.29+) change init-container ordering — review sidecar docs before upgrade
  • Verify metrics-server and HPA after control plane bump

If you're on Terraform 1.7 or older

  • S3 native locking (use_lockfile) differs from DynamoDB — don't mix backends mid-migration
  • Provider version constraints: run terraform init -upgrade after bump
  • terraform test (1.6+) replaces some external test harness patterns

1. Install External Secrets Operator

Config →Guide →

2. Configure Vault KV path

vault kv put secret/apps/myapp db_password=changeme api_key=changeme
vault kv get secret/apps/myapp
Guide →

3. ClusterSecretStore + ExternalSecret

Point to Vault address and auth (K8s auth or token).

Config →

4. Mount in Deployment + rotate

kubectl get externalsecret -n apps
kubectl get secret app-secrets -n apps
kubectl rollout restart deploy/myapp -n apps
Guide →

Related runbook: Open runbook →