External Secrets Operator
Kubernetes operator that fetches secrets from an external store (Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) and projects them as regular K8s Secret objects.
You write an ExternalSecret CR pointing at a secret in an external SecretStore; the operator polls/refreshes and updates the K8s secret when the source changes. Pods read it as usual — the app doesn't know Vault exists.
Beats Vault Agent Sidecar Injector: simpler mental model, no pod-spec changes, lower resource overhead. The standard CNCF route for secret sync in 2024.