Sync secrets from a cloud secret manager

Approach

Install the External Secrets Operator, define a SecretStore (or ClusterSecretStore) authenticated with workload identity, and commit ExternalSecret objects that reference keys. The operator creates and refreshes the Secret.

Solution

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: {name: api-db}
spec:
  refreshInterval: 1h
  secretStoreRef: {name: aws-secrets, kind: ClusterSecretStore}
  target: {name: api-db}
  data:
    - secretKey: password
      remoteRef: {key: prod/api/db, property: password}

Pitfalls

• Static cloud credentials stored in a Secret for the operator; use workload identity (IRSA, Workload Identity).
• Applications reading the value only at startup: rotations need a restart (or a reloader).

Variations

• Sealed Secrets or SOPS when an external secret manager isn't available.
• The Secrets Store CSI driver to mount secrets as files without creating Secret objects.

Further reading: External Secrets Operator