5. An ExternalSecret (source of truth in Vault)
Write an External Secrets Operator ExternalSecret that syncs from Vault: • apiVersion: external-secrets.io/v1beta1 • kind: ExternalSecret • metadata.name: db-creds • spec.secretStoreRef: name = vault-backend, kind = SecretStore • spec.target.name: db-creds • spec.data: a list of ONE entry — secretKey: password, remoteRef: {key: secret/data/app, property: password}
The External Secrets Operator keeps the SOURCE OF TRUTH in an external manager (Vault, cloud) and SYNCS it into a native k8s Secret — so no secret values ever live in Git. `secretStoreRef` points at the backend, `target.name` is the Secret it creates, and each `data` entry maps a local `secretKey` to a `remoteRef` (which key/property to pull). Central rotation happens in Vault; the cluster just gets refreshed copies.