Chapter 82: DevOps Projects Part 12: GitOps Argo CD Multi-Env Vault External Secrets DevSecOps Kyverno

82.4 Project 88: Secrets in Kubernetes with External Secrets

By Ravindra Bagale Last updated: 28 October 2026

Friends, kubectl create secret does not rotate. Today we install External Secrets Operator, point it at Vault or AWS SM, and sync a Secret into a Pod.

What you will build in this project

Install External Secrets Operator.
Create a SecretStore.
Create an ExternalSecret.
Mount the synced Secret in a Pod.

1. Start from a real company story

At ShareChat in Bengaluru, copied Kubernetes Secrets drifted from Vault and an old password broke a Saturday deploy.

Rough cost: about ₹9 lakh in delayed feature launch ads.

Meera synced Secrets from Vault every minute with External Secrets.

Today we sync one secret into a namespace.

Picture 1: Vault/SM → SecretStore → ExternalSecret → K8s Secret → Pod env

Ravindra Bagale's Tip

Students commit the synced Secret YAML back into git. Keep only ExternalSecret manifests; the Secret is cluster data. Keep that habit.

2. Start and prepare

Step 1: Why ESO

Why: Static K8s Secrets rot. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'One upstream store; many clusters stay in sync'

You will see:

One upstream store; many clusters stay in sync

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/eso88 && echo 'Today: ESO, SecretStore, ExternalSecret, Pod'

You will see:

Today: ESO, SecretStore, ExternalSecret, Pod

What it means: Scope.

Example 3: a3

Type this:

echo 'Works with Vault, AWS Secrets Manager, GCP Secret Manager, and more'

You will see:

Works with Vault, AWS Secrets Manager, GCP Secret Manager, and more

What it means: Backends.

Step 2: Install

Why: Helm tip. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: install. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'helm repo add external-secrets https://charts.external-secrets.io' 'helm install external-secrets external-secrets/external-secrets -n external-secrets-system --create-namespace' > /tmp/eso88/INSTALL.txt && cat /tmp/eso88/INSTALL.txt

You will see:

helm install external-secrets ...

What it means: Install.

Example 5: b2

Type this:

echo 'kubectl -n external-secrets-system get pods'

You will see:

kubectl -n external-secrets-system get pods

What it means: Pods.

Example 6: b3

Type this:

echo 'CRDs: SecretStore, ClusterSecretStore, ExternalSecret'

You will see:

CRDs: SecretStore, ClusterSecretStore, ExternalSecret

What it means: CRDs.

Step 3: SecretStore

Why: Point at Vault. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: store. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'apiVersion: external-secrets.io/v1beta1' 'kind: SecretStore' 'metadata:' '  name: vault-backend' '  namespace: shop' 'spec:' '  provider:' '    vault:' '      server: http://vault.vault:8200' '      path: secret' '      version: v2' '      auth:' '        kubernetesAuth:' '          path: kubernetes' '          role: shop' '          serviceAccountRef:' '            name: shop-sa' > /tmp/eso88/store.yaml && wc -l /tmp/eso88/store.yaml

You will see:

21 /tmp/eso88/store.yaml

What it means: Store.

Example 8: c2

Type this:

echo 'kubectl -n shop apply -f /tmp/eso88/store.yaml'

You will see:

kubectl -n shop apply -f /tmp/eso88/store.yaml

What it means: Apply.

Example 9: c3

Type this:

echo 'Prefer Kubernetes auth to Vault over static tokens'

You will see:

Prefer Kubernetes auth to Vault over static tokens

What it means: Auth.

3. Build the main pieces

Step 4: ExternalSecret

Why: Map keys. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: es. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' 'apiVersion: external-secrets.io/v1beta1' 'kind: ExternalSecret' 'metadata:' '  name: shop-db' '  namespace: shop' 'spec:' '  refreshInterval: 1m' '  secretStoreRef:' '    name: vault-backend' '    kind: SecretStore' '  target:' '    name: shop-db' '  data:' '  - secretKey: password' '    remoteRef:' '      key: shop/db' '      property: password' > /tmp/eso88/es.yaml && wc -l /tmp/eso88/es.yaml

You will see:

18 /tmp/eso88/es.yaml

What it means: ES.

Example 11: d2

Type this:

echo 'kubectl -n shop apply -f /tmp/eso88/es.yaml'

You will see:

kubectl -n shop apply -f /tmp/eso88/es.yaml

What it means: Apply.

Example 12: d3

Type this:

echo 'kubectl -n shop get externalsecret'

You will see:

kubectl -n shop get externalsecret

What it means: Get.

Step 5: Synced Secret

Why: Verify. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: secret. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

echo 'kubectl -n shop get secret shop-db -o yaml | head'

You will see:

kubectl -n shop get secret shop-db -o yaml | head

What it means: Secret.

Example 14: e2

Type this:

echo 'Do not commit this Secret manifest to git'

You will see:

Do not commit this Secret manifest to git

What it means: No git.

Example 15: e3

Type this:

printf '%s\n' 'Acceptance: Secret shop-db exists and updates within refreshInterval after Vault rotate' > /tmp/eso88/ACCEPT.txt && cat /tmp/eso88/ACCEPT.txt

You will see:

Acceptance: Secret shop-db exists and updates within refreshInterval after Vault rotate

What it means: Gate.

Step 6: Pod mount

Why: envFrom. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: pod. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'envFrom:' '- secretRef:' '    name: shop-db' > /tmp/eso88/POD.txt && cat /tmp/eso88/POD.txt

You will see:

name: shop-db

What it means: envFrom.

Example 17: f2

Type this:

echo 'Restart pods after sync if the app caches env at boot'

You will see:

Restart pods after sync if the app caches env at boot

What it means: Restart.

Example 18: f3

Type this:

echo 'Some apps reload on file watch when you mount as files'

You will see:

Some apps reload on file watch when you mount as files

What it means: Files.

4. Automate and verify

Step 7: AWS SM tip

Why: Same pattern. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'provider:' '  aws:' '    service: SecretsManager' '    region: ap-south-1' '    auth:' '      jwt:' '        serviceAccountRef:' '          name: shop-sa' > /tmp/eso88/AWS.txt && cat /tmp/eso88/AWS.txt

You will see:

service: SecretsManager

What it means: AWS.

Example 20: g2

Type this:

echo 'IRSA/OIDC for the operator or the app SA — no static keys'

You will see:

IRSA/OIDC for the operator or the app SA — no static keys

What it means: OIDC.

Example 21: g3

Type this:

echo 'remoteRef.key is the secret name in Secrets Manager'

You will see:

remoteRef.key is the secret name in Secrets Manager

What it means: Key.

Step 8: Failure modes

Why: Ready false. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: fail. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'kubectl -n shop describe externalsecret shop-db'

You will see:

kubectl -n shop describe externalsecret shop-db

What it means: Describe.

Example 23: h2

Type this:

echo 'Common: wrong Vault path, expired SA token, missing policy'

You will see:

Common: wrong Vault path, expired SA token, missing policy

What it means: Common.

Example 24: h3

Type this:

echo 'Status condition SecretSynced=False shows the error'

You will see:

Status condition SecretSynced=False shows the error

What it means: Status.

Step 9: RBAC

Why: Who can read. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: rbac. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'Limit Secret access with Role bindings per namespace' 'Operators need get/list/watch on ExternalSecrets' > /tmp/eso88/RBAC.txt && cat /tmp/eso88/RBAC.txt

You will see:

Limit Secret access with Role bindings per namespace

What it means: RBAC.

Example 26: i2

Type this:

echo 'ClusterSecretStore is powerful; prefer namespaced SecretStore first'

You will see:

ClusterSecretStore is powerful; prefer namespaced SecretStore first

What it means: Scope.

Example 27: i3

Type this:

echo 'Audit who can create ExternalSecrets in prod'

You will see:

Audit who can create ExternalSecrets in prod

What it means: Audit.

5. Harden and accept

Step 10: Story ShareChat

Why: Drifted Secret. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At ShareChat in Bengaluru, copied Secrets drifted from Vault and broke a Saturday deploy.' 'Meera synced with External Secrets every minute.' > /tmp/eso88/STORY.txt && wc -l /tmp/eso88/STORY.txt

You will see:

2 /tmp/eso88/STORY.txt

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹9 lakh in delayed launch ads'

You will see:

Rough cost: about ₹9 lakh in delayed launch ads

What it means: Cost.

Example 30: j3

Type this:

echo 'Meera: PASS'

You will see:

Meera: PASS

What it means: Sign-off.

Step 11: Proof

Why: Files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

ls /tmp/eso88

You will see:

ACCEPT.txt\nAWS.txt\nINSTALL.txt\nPOD.txt\nRBAC.txt\nSTORY.txt\nes.yaml\nstore.yaml

What it means: Tree.

Example 32: k2

Type this:

grep refreshInterval /tmp/eso88/es.yaml

You will see:

refreshInterval: 1m

What it means: Interval.

Example 33: k3

Type this:

echo 'Next: DevSecOps pipeline project 89'

You will see:

Next: DevSecOps pipeline project 89

What it means: Bridge.

Step 12: Acceptance

Why: Synced Secret in Pod. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'ESO installed'

You will see:

ESO installed

What it means: Install.

Example 35: z2

Type this:

echo 'ExternalSecret Synced'

You will see:

ExternalSecret Synced

What it means: Sync.

Example 36: z3

Type this:

echo 'Pod reads password from Secret'

You will see:

Pod reads password from Secret

What it means: Pod.

Check yourself

Q1. Who fixed ShareChat drift?

Meera

Q2. Operator?

External Secrets

Q3. CRD store?

SecretStore

Q4. CRD map?

ExternalSecret

Q5. Git the Secret?

Q6. Refresh?

interval

Friends, you synced a Secret from an external store. Did you understand? Let us try it once more. Rotate the value upstream and prove the Pod env updates after refresh.

Lab: try at home

Install ESO.
SecretStore.
ExternalSecret.
Pod uses synced Secret.

Recap

Operator syncs.
Store is upstream.
ExternalSecret is the map.
Do not git the Secret.
Refresh interval matters.