External Secrets Operator Guide

# This is what you want in Git:
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
data:
  password: cGFzc3dvcmQxMjM=  # ← Base64 is not encryption

helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets --create-namespace

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: aws-secrets
spec:
  provider:
    aws:
      service: SecretsManager
      region: eu-west-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa
            namespace: external-secrets

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: https://vault.myorg.com
      path: secret
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: azure-kv
spec:
  provider:
    azurekv:
      tenantId: "your-tenant-id"
      vaultUrl: "https://myorg-kv.vault.azure.net"
      authType: WorkloadIdentity
      serviceAccountRef:
        name: external-secrets-sa

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets
    kind: ClusterSecretStore
  target:
    name: db-credentials
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: production/database
        property: username
    - secretKey: password
      remoteRef:
        key: production/database
        property: password

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-credentials
        key: password

In Git (ExternalSecret YAML):          In AWS/Vault (actual values):
  - Secret name: db-credentials          - username: app_user
  - Source: production/database           - password: s3cur3-p@ssw0rd
  - Refresh: every 1 hour                - host: db.internal.myorg.com
  - Target namespace: production

spec:
  refreshInterval: 15m  # Check for updates every 15 minutes

metadata:
  annotations:
    reloader.stakater.com/auto: "true"

spec:
  target:
    name: db-connection
    template:
      engineVersion: v2
      data:
        connection_string: "postgresql://{{ .username }}:{{ .password }}@{{ .host }}:5432/{{ .database }}"
  data:
    - secretKey: username
      remoteRef:
        key: production/database
        property: username
    - secretKey: password
      remoteRef:
        key: production/database
        property: password
    - secretKey: host
      remoteRef:
        key: production/database
        property: host
    - secretKey: database
      remoteRef:
        key: production/database
        property: database

spec:
  data:
    - secretKey: db-password
      remoteRef:
        key: production/database
        property: password
      sourceRef:
        storeRef:
          name: aws-secrets
          kind: ClusterSecretStore
    - secretKey: api-key
      remoteRef:
        key: secret/data/api-keys
        property: stripe
      sourceRef:
        storeRef:
          name: vault
          kind: ClusterSecretStore