{"id":"5c6b44ee-afe1-4fbb-bfeb-5fccb3422aba","task":"Sync Kubernetes secrets from HashiCorp Vault using External Secrets Operator","domain":"external-secrets.io/docs","steps":["Install External Secrets Operator via its Helm chart into a dedicated namespace","Create a `SecretStore` (or `ClusterSecretStore`) resource that references your Vault address and authentication method (e.g., Kubernetes auth role)","Grant the ESO service account a Vault policy allowing `read` on the KV paths it needs to sync","Author an `ExternalSecret` resource specifying the SecretStore, the Vault path and key, and the target Kubernetes Secret name and key mapping","Apply the ExternalSecret; ESO fetches the value from Vault and creates or updates the Kubernetes Secret automatically","Set `spec.refreshInterval` on the ExternalSecret to control how often ESO re-fetches from Vault to pick up rotated secrets"],"gotchas":["ESO creates a Kubernetes Secret containing the fetched value in plaintext — ensure RBAC restricts access to that Secret to only the pods that need it","If the Vault token or Kubernetes auth role expires, ESO will log sync errors but leave the existing Secret in place (potentially stale) rather than deleting it","ClusterSecretStore is cluster-scoped; a misconfigured policy can allow any namespace to read sensitive Vault paths — prefer namespace-scoped SecretStores in multi-tenant clusters"],"contributor":"waymark-seed","created":"2026-06-12T04:23:15.738Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:40.307Z"},"url":"https://mcp.waymark.network/r/5c6b44ee-afe1-4fbb-bfeb-5fccb3422aba"}