External Secrets Operator#

Overview#

External Secrets Operator (ESO) syncs secrets from OpenBao KV into native Kubernetes Secret resources, for consumers that read their secrets from disk. ESO is delivered as an Argo CD Application after OpenBao, before the consumers that depend on it.

How it works#

ESO runs the upstream external-secrets controller and uses the OpenBao (HashiCorp Vault) provider to authenticate to OpenBao with the Kubernetes auth method and read KV-v2 paths under the nmc mount.

Each consumer owns its own integration objects rather than sharing a cluster-wide one:

  • A per-namespace SecretStore, keyed to that consumer’s own Kubernetes auth role. The role scopes which KV paths the consumer can read.

  • One or more ExternalSecret resources that map KV fields into a named Secret in the consumer’s namespace.

ESO reconciles each target Secret against its KV source. Keycloak owns its SecretStore and a database ExternalSecret. That ExternalSecret syncs keycloak/database into the keycloak-cnpg-cluster-password Secret in the keycloak namespace. Refer to Keycloak for how the database consumes that Secret. Launchpad reads the shared NGC image-pull credential the same way.

Configuration#

Add these settings under the externalSecrets key in values.yaml. The key already carries the pinned version and syncWave from Installing GitOps-Managed Components; the following fields are the ones you set. A field shown with a value uses that value as its default when you omit it.

externalSecrets:
  enabled: true                    # optional, deploy the ESO Application
  replicaCount: 2                  # optional, controller replicas for high availability
  webhookReplicaCount: 1           # optional, webhook replicas
  certControllerReplicaCount: 1    # optional, cert-controller replicas
  serviceMonitorEnabled: true      # optional, Prometheus ServiceMonitor

  • enabled – deploy the ESO Application. Default true.

  • replicaCount – controller replica count. Default 2 for high availability.

  • webhookReplicaCount – webhook replica count. Default 1.

  • certControllerReplicaCount – cert-controller replica count. Default 1.

  • serviceMonitorEnabled – emit a ServiceMonitor for Prometheus scraping. Default true.

The Application installs the ESO CRDs (SecretStore, ExternalSecret) consumed by the Keycloak and Launchpad tiers, so it must sync before any Application that declares those resources.

Secrets#

External Secrets Operator consumes no bootstrap secrets. It reads the OpenBao KV paths the configure Job populates, using each consumer’s reader role.

Verify#

Confirm the ESO Application is Healthy and Synced in Argo CD, then confirm the controller, webhook, and cert-controller pods are running:

kubectl -n external-secrets get pods

Confirm a target Secret is being reconciled from KV by checking that the consumer’s ExternalSecret reports Ready and that its target Secret is present:

kubectl -n keycloak get externalsecret
kubectl -n keycloak get secret keycloak-cnpg-cluster-password

A Ready ExternalSecret with its target Secret present confirms ESO read the KV source.