The GitOps Secret Leakage Problem

In a declarative GitOps workflow, all Kubernetes manifests are stored in a Git repository. Because standard Secrets are only base64 encoded, storing secret manifests in Git exposes credentials to anyone with repository access.

To solve this, credentials should be managed in a dedicated Key Management Service (KMS) like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault.

External Secrets Operator (ESO)

The External Secrets Operator (ESO) is a Kubernetes operator that integrates with external secret management systems. It runs a controller reconciliation loop that reads API credentials from external managers and automatically generates native Kubernetes Secrets inside your cluster namespace.

How ESO Works

1. A administrator configures a SecretStore defining connection details and authentication parameters to the external KMS (e.g. AWS IAM role or Vault authentication token).
2. A developer creates an ExternalSecret manifest specifying which secret keys to fetch and mapping them to a local Kubernetes Secret name.
3. The ESO controller continuously polls the external manager API and generates/updates the native Kubernetes Secret accordingly.

ESO Manifest Examples

Here is a configuration declaring a connection to HashiCorp Vault, along with an ExternalSecret that maps Vault keys:

# 1. SecretStore Configuration (Vault Endpoint)
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "https://vault.company.com:8200"
      path: "secret"
      version: "v2"
      auth:
        tokenSecretRef:
          name: vault-token-secret
          key: token
2. ExternalSecret Request Manifest
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: local-db-credentials
spec:
  refreshInterval: "1h" # Sync frequency
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  # Target local K8s secret to generate
  target:
    name: k8s-db-credentials
    creationPolicy: Owner
  data:
  - secretKey: DB_PASSWORD
    remoteRef:
      key: prod/db
      property: password