Ross ROSS = Recommend OSS · open-source software intelligence for agents

external-secrets/external-secrets

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets. observed · 2026-08-28

github.com/external-secrets/external-secrets · homepage · Go · Apache-2.0 (permissive) observed · 2026-08-28

Health v2 · maintenance only

94/100

  • Activity 99
  • Release rhythm 84
  • Longevity 100
How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: 1
  • age_days: 2115
  • days_rel: 25
  • days_push: 7
  • n_releases_24m: 106

Full methodology

Adoption not part of the score

6808 stars · 1405 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

External Secrets Operator is a Kubernetes operator that synchronizes secrets from external secret management systems such as AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, and Azure Key Vault into native Kubernetes Secrets. It exposes custom resources (ExternalSecret, SecretStore, ClusterSecretStore) that abstract away provider-specific APIs and keep cluster secrets continuously refreshed.

Use cases

  • sync secrets from AWS Secrets Manager into Kubernetes
  • inject Vault secrets into my cluster automatically
  • avoid storing credentials in Kubernetes Secrets directly
  • keep Kubernetes Secrets in sync with Azure Key Vault
  • manage secrets across multiple clusters from one provider
  • rotate external secrets into Kubernetes on a schedule

When to choose

  • you run workloads on Kubernetes and use an external secret manager
  • you want declarative, GitOps-friendly secret syncing via CRDs
  • you need support for many secret providers behind one operator
  • you want automatic refresh intervals and sync status tracking

When to avoid

  • you are not running Kubernetes
  • you need a general-purpose secrets manager rather than a sync tool
  • you want client-side secret injection without a cluster operator
  • you need CSI-mounted secrets rather than Secret resources

Facets

service · maturity stable

secrets-management deployment configuration-management security security cloud-computing self-hosted go cloud self-hosted kubernetes-operator secrets-sync aws-secrets-manager hashicorp-vault azure-key-vault helm-chart crds devops containers kubernetes docker

5 sources

Member repositories

RepositoryRoleHealth v2
external-secrets/external-secretsmain94

For agents

markdown · JSON · MCP: product_card(name="external-secrets/external-secrets")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem