Skip to content

External Secrets Operator

What is the External Secrets Operator?

The External Secrets Operator is a specialized Kubernetes operator designed to streamline and enhance the management of external secrets. It serves as an integration bridge between Kubernetes clusters and external secret management systems, including but not limited to AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, and many others. This operator plays a pivotal role in automating the retrieval and injection of secret values from these external systems into Kubernetes Secrets.

The Goals of the External Secrets Operator

The primary objective of the External Secrets Operator is to facilitate the seamless synchronization of secrets from external APIs into Kubernetes environments. This synchronization process is achieved through the utilization of a set of custom API resources:

ExternalSecret

The ExternalSecret resource acts as a central descriptor, orchestrating the retrieval and transformation of external secret data. It empowers you to specify which secrets should be synchronized, providing the flexibility to either explicitly sync individual keys using spec.data or retrieve all values from the external API using spec.dataFrom. Moreover, you can define the structure and format of the Kubernetes Secret that will store these secrets using the spec.target.template.

SecretStore

The SecretStore resource operates within a Kubernetes namespace and serves as a vital link to external APIs. Each SecretStore corresponds precisely to one instance of an external API. It encapsulates the necessary configuration details, such as authentication and endpoint information, ensuring secure and controlled access to external APIs. The SecretStore is pivotal in managing the lifecycle of secrets and their secure integration into Kubernetes.

ClusterSecretStore

The ClusterSecretStore resource is an extension of the SecretStore but operates at the cluster level. It allows for centralized management of external API configurations across namespaces within the cluster, promoting efficiency and consistency in secret retrieval and management.

In summary, the External Secrets Operator not only simplifies the complex task of handling external secrets but also introduces a user-friendly abstraction layer. This abstraction shields you from the intricacies of external API interactions while providing a robust and secure mechanism to manage secrets effectively within Kubernetes.

Note: Within our 01Cloud environment, we are currently leveraging the capabilities of the ExternalSecret and SecretStore resources.