Managing External Secrets

helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  -n external-secrets --create-namespace --set installCRDs=true

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata: { name: aws-sm, namespace: prod }
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth: { jwt: { serviceAccountRef: { name: esa-sa } } }

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata: { name: db, namespace: prod }
spec:
  refreshInterval: 1h
  secretStoreRef: { name: aws-sm, kind: SecretStore }
  target: { name: db-secret, creationPolicy: Owner }
  data:
  - secretKey: password
    remoteRef: { key: prod/db, property: password }

target:
  template:
    type: kubernetes.io/dockerconfigjson
    data:
      .dockerconfigjson: |
        { "auths": { "registry.io": { "auth": "{{ .auth | b64enc }}" }}}

dataFrom:
- extract: { key: prod/db }   # all keys from secret
- find:    { name: { regexp: "^prod/.*" } }