External Secrets Operator

External Secrets Operator is a Kubernetes operator for using external secret management systems with Kubernetes. It reads secret data from external APIs and injects the values into Kubernetes Secrets, so workloads can consume Kubernetes-native secrets while the source data stays in an external secret manager.

Supported systems include AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, Akeyless, CyberArk Secrets Manager, Pulumi ESC, and more. The operator automates the flow from an external API into a Kubernetes Secret.

It runs inside the cluster as a controller and keeps Kubernetes Secrets in sync with their source, so values are refreshed when they change in the external store. Each release ships an SBOM and provenance file, and those artifacts are also attached to the container images for supply chain verification.