External Secrets Operator
Synchronizes secrets from external stores into Kubernetes.
Component Category
Access and security / secret management
Component Description
External Secrets Operator (ESO) reads secret data from external providers (cloud key vaults, HashiCorp Vault, AWS Secrets Manager, and others) and creates native Kubernetes Secret resources. It uses ExternalSecret and SecretStore custom resources to define what to sync and where from.
Why It Is Used
In BullSequana AI, External Secrets Operator allows the platform to integrate with external secret management systems already in use by the organization. This avoids duplicating secret material across systems and supports enterprise secret governance policies without requiring changes to how platform components consume secrets.
Learn More
Deployment notes
External Secrets Operator deploys into the external-secrets namespace at sync wave 12 in the common tier, the last common-tier component. It runs one operator replica and one webhook replica. Webhook TLS is managed by cert-manager. A ClusterSecretStore is created to connect with the OpenBao backend.
Interacts With
OpenBao, which serves as the external secret store that ESO syncs from in the current platform configuration.