# external-secrets/external-secrets

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

Repository: https://github.com/external-secrets/external-secrets
Canonical: https://ross.abutalabs.com/products/external-secrets
Homepage: https://external-secrets.io/main
Language: Go
License: Apache-2.0
License Family: permissive
Topics: external-secrets, kubernetes, kubernetes-secrets, secrets-manager, hacktoberfest
Last push: 2026-08-26T13:11:04+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 84, longevity 100
- inputs: {"age_days": 2115, "days_push": 7, "days_rel": 25, "gap_med": 1, "n_releases_24m": 106}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6808, forks 1405 (observed 2026-08-28T04:09:48.746161+00:00)

## What it is
External Secrets Operator is a Kubernetes operator that synchronizes secrets from external secret management systems such as AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, and Azure Key Vault into native Kubernetes Secrets. It exposes custom resources (ExternalSecret, SecretStore, ClusterSecretStore) that abstract away provider-specific APIs and keep cluster secrets continuously refreshed.

## Use cases
- sync secrets from AWS Secrets Manager into Kubernetes
- inject Vault secrets into my cluster automatically
- avoid storing credentials in Kubernetes Secrets directly
- keep Kubernetes Secrets in sync with Azure Key Vault
- manage secrets across multiple clusters from one provider
- rotate external secrets into Kubernetes on a schedule

## When to choose
- you run workloads on Kubernetes and use an external secret manager
- you want declarative, GitOps-friendly secret syncing via CRDs
- you need support for many secret providers behind one operator
- you want automatic refresh intervals and sync status tracking

## When to avoid
- you are not running Kubernetes
- you need a general-purpose secrets manager rather than a sync tool
- you want client-side secret injection without a cluster operator
- you need CSI-mounted secrets rather than Secret resources

## Facets
- artifact type: service
- maturity: stable
- function: secrets-management, deployment, configuration-management, security
- domain: security, cloud-computing, self-hosted
- platform: go, cloud, self-hosted
- tags: kubernetes-operator, secrets-sync, aws-secrets-manager, hashicorp-vault, azure-key-vault, helm-chart, crds, devops, containers, kubernetes, docker

## Member repositories
- external-secrets/external-secrets (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:48.746161+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:42:02.643148+00:00, confidence not recorded.
  - readme: https://github.com/external-secrets/external-secrets (fetched 2026-08-28T04:09:48.746161+00:00, sha f50b20ec33fe)
  - homepage: https://external-secrets.io/main (fetched 2026-08-29T08:38:07.407516+00:00, sha 16a477a156bf)
  - site_page: https://external-secrets.io/main/introduction/getting-started (fetched 2026-08-29T08:38:07.417070+00:00, sha 8f74541d51c8)
  - site_page: https://external-secrets.io/main/guides/disable-cluster-features (fetched 2026-08-29T08:38:07.421236+00:00, sha 95ba007005f0)
  - site_page: https://external-secrets.io/main/introduction/faq (fetched 2026-08-29T08:38:07.419283+00:00, sha d9844fab7967)
- Data as of 2026-08-30T08:39:29.467469+00:00.