External Secrets Operator (ESO) is a Kubernetes operator that connects applications to credentials stored in external secrets management systems. It retrieves sensitive information from supported providers and synchronizes the values with Kubernetes Secret objects.
The software separates secret storage from application configuration. Administrators define which credentials should be retrieved and how they should appear inside Kubernetes, without embedding sensitive values directly in deployment manifests. This approach is particularly useful for organisations managing credentials across multiple clusters, namespaces and environments.
This is free and open source software.
Key Features
- Extensive provider support – integrates with AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager, CyberArk Conjur, OpenBao and numerous other services.
- Automatic synchronization – keeps Kubernetes Secret objects aligned with values held by external providers.
- ExternalSecret resources – define individual credentials, remote references and destination Kubernetes Secrets.
- SecretStore and ClusterSecretStore – configure access to providers at namespace or cluster level.
- Configurable refresh policies – supports periodic synchronization, change-triggered updates and one-time retrieval.
- Advanced templating – transforms retrieved values using Go templates, functions and configurable output structures.
- ClusterExternalSecret resources – distribute common secret definitions across selected Kubernetes namespaces.
- PushSecret functionality – writes Kubernetes Secret values to supported external secret management systems.
- Secret generators – create passwords, UUIDs, tokens and other credentials using dedicated generators.
- Fine-grained access control – supports Kubernetes RBAC, scoped provider credentials and multi-tenant configurations.
- Lifecycle management – controls ownership, creation, merging and deletion of managed Kubernetes Secrets.
Website: github.com/external-secrets/external-secrets
Support:
Developer: External Secrets community
License: Apache License 2.0
External Secrets Operator is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Secrets Management | |
|---|---|
| OpenBao | Manage, store, and distribute sensitive data |
| SOPS | Editor of encrypted files |
| Sealed Secrets | One-way encrypted secrets |
| Vault | Tool for securely accessing secrets |
| Infisical | Secrets management, PKI, and SSH access |
| fnox | Encrypted/remote secret manager |
| Envy | Slick TUI for browsing secrets and a CLI for automation |
| Chamber | Modern secret management solution |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.