🔐
Security

External Secrets Operator

Sync secrets from AWS/GCP/Vault into Kubernetes automatically

🐧 Linux🍎 Mac🪟 Windows
Reviewed: Tested on: Kubernetes 1.29 · Terraform 1.8 · Ubuntu 22.04

If you're on Kubernetes 1.27 or older

  • Ingress: networking.k8s.io/v1 is required — v1beta1 removed in 1.22+
  • Pod Security: PodSecurityPolicy removed in 1.25 — use Pod Security Admission (PSA) labels
  • HPA v2 autoscaling/v2 is stable — check API version in manifests

If you're on Kubernetes 1.28

  • Sidecar containers (1.29+) change init-container ordering — review sidecar docs before upgrade
  • Verify metrics-server and HPA after control plane bump

✓ Team golden path — Secrets management

Sync cloud/Vault secrets into K8s Secrets

What is this?

External Secrets Operator pulls secrets from AWS/GCP/Vault into Kubernetes Secret objects automatically.

📁

Config files for External Secrets Operator

Where to create or edit the main configuration — paths below match the setup steps.

  • secret-store.yaml

    Location: Kubernetes namespace

    Connects cluster to AWS/Vault/GCP secret backends

📥

Step 01

Install External Secrets Operator

(01)Install External Secrets Operator

Linux
1helm repo add external-secrets https://charts.external-secrets.io
2helm repo update
3helm install external-secrets external-secrets/external-secrets -n external-secrets --create-namespace
⚙️

Step 02

Configure External Secrets Operator

(01)Configure External Secrets Operator

Linux
1cat > secret-store.yaml << 'EOF'
2apiVersion: external-secrets.io/v1beta1
3kind: SecretStore
4metadata:
5  name: aws-secrets
6  namespace: default
7spec:
8  provider:
9    aws:
10      service: SecretsManager
11      region: us-east-1
12EOF
13kubectl apply -f secret-store.yaml
✅

Step 03

Verify

(01)Verify installation

Linux
1kubectl get pods -n external-secrets
2kubectl get secretstore,externalsecret -A
🔧

Step 04

Common Problems

#1ExternalSecret not syncing

Linux
1kubectl describe externalsecret -n default
2kubectl logs -n external-secrets -l app.kubernetes.io/name=external-secrets
3kubectl get secretstore -A

#2AWS IAM permission errors

Linux
1# Use IRSA — annotate SA with role ARN
2kubectl annotate sa default eks.amazonaws.com/role-arn=arn:aws:iam::ACCOUNT:role/eso-role

📋Config templates

2 YAML templates for External Secrets Operator. Copy and deploy after setup.

2 ready-to-copy templates. Expand one, copy the YAML, then run the deploy commands.

ConfigMap.yml

yaml
1apiVersion: v1
2kind: ConfigMap
3metadata:
4  name: node-demo-config
5data:
6  NORMAL_ENV_VALUE: "hello-from-configmap"

Secrets.yml

yaml
1apiVersion: v1
2kind: Secret
3metadata:
4  name: mysecret
5type: Opaque
6stringData:
7  SECRET_ENV_VALUE: "super-secret-value"

Deployment.yml

Deployment referencing ConfigMap and Secret via env valueFrom

yaml
1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: api-deploy-demo-secrets-config
5  labels:
6    app: api-deploy-demo-secrets-config
7spec:
8  replicas: 1
9  selector:
10    matchLabels:
11      app: api-deploy-demo-secrets-config
12  template:
13    metadata:
14      labels:
15        app: api-deploy-demo-secrets-config
16    spec:
17      containers:
18        - name: api-demo-cms
19          image: api-demo-cms:local
20          imagePullPolicy: IfNotPresent
21          ports:
22            - containerPort: 3000
23          env:
24            - name: SECRET_ENV_VALUE
25              valueFrom:
26                secretKeyRef:
27                  name: mysecret
28                  key: SECRET_ENV_VALUE
29            - name: NORMAL_ENV_VALUE
30              valueFrom:
31                configMapKeyRef:
32                  name: node-demo-config
33                  key: NORMAL_ENV_VALUE
34          resources:
35            limits:
36              memory: "512Mi"
37              cpu: "500m"
38            requests:
39              memory: "256Mi"
40              cpu: "250m"

Services.yml

yaml
1apiVersion: v1
2kind: Service
3metadata:
4  name: api-demo-service
5spec:
6  type: NodePort
7  selector:
8    app: api-deploy-demo-secrets-config
9  ports:
10    - port: 3000
11      targetPort: 3000
12      nodePort: 32001
📄

Step 01

Apply ConfigMap & Secrets

(01)Create ConfigMap and Secret first

Linux
1kubectl apply -f ConfigMap.yml
2kubectl apply -f Secrets.yml
3kubectl apply -f Deployment.yml
4kubectl apply -f Services.yml
5kubectl get configmap,secret,pods

(02)Verify env vars inside pod

Linux
1kubectl exec -it deploy/api-deploy-demo-secrets-config -- env | grep ENV_VALUE