Pulling from External Secrets Operators
Sourcing secrets from a vault at deploy time.
Pulling from External Secrets Operators is a free Helm Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Keep Secrets Outside the Chart
Another approach skips storing secrets near the chart at all. You keep them in a dedicated vault and pull them in at deploy time.
A Single Source of Truth
A secret store like HashiCorp Vault or AWS Secrets Manager becomes your source of truth, separate from any chart or repository.
The External Secrets Operator
The External Secrets Operator, often called ESO, runs in your cluster and copies values from an external store into Kubernetes Secrets.
Install ESO with Helm
Fittingly, you install the operator itself with Helm from its public chart, then it watches for resources telling it what to sync.
helm install external-secrets external-secrets/external-secretsConnect with a SecretStore
A SecretStore resource tells ESO where your vault is and how to authenticate to it, so it can read secrets on your behalf.
kind: SecretStore
spec:
provider:
vault:
server: https://vault.example.comRequest with ExternalSecret
An ExternalSecret resource names which remote keys you want and which Kubernetes Secret ESO should create from them.
kind: ExternalSecret
spec:
target:
name: db-credentialsESO Materializes the Secret
The operator reads the vault and materializes a normal Kubernetes Secret. Your pods consume it like any other Secret.
Your Chart Ships No Secrets
Now your chart only ships the ExternalSecret manifest, never the credential. The sensitive value lives solely in the vault. 🔐
Automatic Refresh
ESO can refresh the Secret on an interval, so rotating a value in the vault propagates into the cluster without a redeploy.
spec:
refreshInterval: 1hReference It in values.yaml
Your chart values then just hold the name of the synced Secret, never the secret itself, keeping configuration safe to commit.
existingSecret: db-credentialsDecoupled Responsibility
This model decouples who manages secrets from who deploys apps. Security teams own the vault; chart authors just reference it.
Quick Check
What does the External Secrets Operator actually do?
Recap
You saw how the External Secrets Operator syncs values from a vault into Kubernetes Secrets, so charts ship only references. 🎉
Frequently asked questions
Is the “Pulling from External Secrets Operators” lesson free?
Yes — the full text of “Pulling from External Secrets Operators” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.
What will I learn in “Pulling from External Secrets Operators”?
Sourcing secrets from a vault at deploy time. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Helm Academy?
No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Pulling from External Secrets Operators” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Helm Academy lesson?
Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Secrets Do Not Belong in values.yaml
- Encrypting Values with helm-secrets and SOPS
- Pulling from External Secrets Operators
- Templating Kubernetes Secret Resources