{"id":26487760,"url":"https://github.com/sebagomez/eso-demo","last_synced_at":"2026-04-16T12:05:29.147Z","repository":{"id":155579435,"uuid":"616622015","full_name":"sebagomez/eso-demo","owner":"sebagomez","description":"🔒 External Secrets Operator demo","archived":false,"fork":false,"pushed_at":"2023-06-01T13:00:38.000Z","size":11130,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-10-29T16:21:36.145Z","etag":null,"topics":["external-secrets","external-secrets-operator","kubernetes","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sebagomez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-03-20T18:45:24.000Z","updated_at":"2024-07-11T13:49:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"9b63f842-d5c6-4fe3-b6db-1098c6fb3c3c","html_url":"https://github.com/sebagomez/eso-demo","commit_stats":{"total_commits":36,"total_committers":2,"mean_commits":18.0,"dds":0.02777777777777779,"last_synced_commit":"4f40d5979ebb26328b5fa4293abd2e3d717f17bd"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebagomez%2Feso-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebagomez%2Feso-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebagomez%2Feso-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebagomez%2Feso-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sebagomez","download_url":"https://codeload.github.com/sebagomez/eso-demo/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244450137,"owners_count":20454598,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["external-secrets","external-secrets-operator","kubernetes","terraform"],"created_at":"2025-03-20T06:52:53.274Z","updated_at":"2026-04-16T12:05:29.115Z","avatar_url":"https://github.com/sebagomez.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# eso-demo\nDemo for the [External Secrets Operator](https://external-secrets.io) at github.com/sebagomez/eso-demo\n\n\n## Introduction\n\nThis repo holds the needed yaml to perform a demo on ESO. These are the features that are easily demoed with this repo.\n- Get the value of a secret from an external provider\n- Get the metadata of a secret from an external provider\n- Push a `Secret` from the cluster to an external provider.\n\nEvery suppoerted provider (in this repo) has its corresponding terraform files to spin up the infrastructure. The infrastructure means the secrets themselves, and the infra to access them, IAM user for AWS, App and Service Principal for Azure, Role and ServiceAccount for Kubernetes an so on.\n\nTo execute this demo in your own environment keep in mind I assume you already have a few prerequisites in place.\n- An accesible cluster and kubectl configure to work with it. In my case I'm using minikube.\n- An AWS account and the aws cli configured (if you want to test AWS Secret Manager or AWS Parameter Store)\n- An Azure account and the az cli configured (if you want to test Azure Key Vault)\n- In this demo I'm also using a local instance of HashiCorp Vault, so you might want to have Helm installed if you want to follow along.\n\n\u003e If you still don't have access to any external provider or a local instance or Vault, you can still play around with the Kubernetes provider.\n\n## How does it work?\n\nWith this repo (and the prerequisites) I'll have access to a Kubernetes cluster with the External Secrets Operator installed and I will create a few `ClusterSecretStore` to access the different providers. I'll also create the infrastructure (as mentioned before) in the providers and a few secrets in each of them. For the purpose of the demo, I'm creating thre secrets with the same name in all different providers. These secrets are called `secret-one`, `secret-two` and `three`, and the also share the same tags (`dev`, `example`, and `provider`).\n\n### Why ?\n\nBecause I want to show that without modifying the `ExternalSecret` definition I can use different provider to get the secrets.\n\n![](./res/architecture.png)\n\n## Set up\n\nLike I said, I'm using a local [minikube](https://minikube.sigs.k8s.io/docs/start/) cluster but obviously any K8s cluster works. I'm also using Helm to install the External Secret Operator and Vault for local testings.\n\nI took the instructions from the ESO site, but as the moment of this writing it was as easy as adding the repo \n\n```bash\nhelm repo add external-secrets https://charts.external-secrets.io \u0026\u0026 helm repo update\n```\n\nand install the ESO Helm chart\n\n```bash\nhelm install external-secrets external-secrets/external-secrets --create-namespace --namespace external-secrets\n```\n\nand that's it!, ESO is not up \u0026 running\n\nI'm also using Terraform to create some secrets (and the infrastructure) in the different providers. If you want to do the same make sure you have [Terraform installed](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) in your machine.\n\n## Accessing the provider\n\nIn this example I'll use [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html), [AWS Secret STore](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html), [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/), a local (dev) installation of [Hashicorp Vault](https://www.hashicorp.com/products/vault), and also the [Kubernetes provider](https://external-secrets.io/v0.8.1/provider/kubernetes/).\n\n\n### Hashicorp Vault\n\nIf you're going to install Hashicorp Vault in your local cluster like I did, you need to do it in two steps. First, `cd` into the [terraform/vault](./terraform/vault/) folder and execute `terraform apply`. After that is than you will have to espose Vault to create the secrets with Terraform. \n```bash\nkubectl port-forward svc/vault -n vault 8200:8200\n```\nNow can now `cd` into the [secrets](./terraform/vault/secrets/) folder (in another terminal window) and run `terraform apply` from there. This second apply is the one that creates the secret.\n\nThere's a tiny script called [tf.sh](./terraform/vault/tf.sh) that will of of the above from you if you prefer. Make sure you set the right parameter.\n\n```bash\n./tf.sh [apply|destroy]\n```\n\nAfter everything is created, you can now create you `ClusterSecretStore` for Hashicorp Vault.\n\n```bash\nkubectl apply -f ClusterSecretStores/hashicorp-vault/vault-secretstore.yaml\n```\n\n### AWS\n\nTo create a few secrets and the IAM user to access them in AWS Secrets Manager and AWS Parameter Store you can `terraform apply` from [terraform/aws](./terraform/aws/). The following script would do everything for you.\n\n\u003e It assumes the [aws cli](https://aws.amazon.com/cli/) tool is properly installed and configured\n\n```bash\ncd terraform/aws || return 1\nterraform init \u0026\u0026 terraform apply\nexport AWS_KEY=$(cat ./terraform.tfstate | jq '.resources[1].instances[0].attributes.id' --raw-output)\nexport AWS_SECRET=$(cat ./terraform.tfstate | jq '.resources[1].instances[0].attributes.secret' --raw-output)\n# Create the Secret with AWS credentials\nkubectl create secret generic aws-credentials --namespace cred --from-literal=access-key=$AWS_KEY --from-literal=secret=$AWS_SECRET\nexport AWS_REGION=$(aws configure get region)\n# Create the ClusterSecretStore for AWS Secret Manager\neval \"echo \\\"$(cat ../../ClusterSecretStores/aws/awssm_secretstore.template.yaml)\\\"\" | kubectl apply -f -\n# And/Or create the ClusterSecretStore for AWS Parameter Store\neval \"echo \\\"$(cat ../../ClusterSecretStores/aws/awsps_secretstore.template.yaml)\\\"\" | kubectl apply -f -\n```\n\n### Azure Key Vault\n\nTo create a few secrets and the user to access them in Azure Key Vault you can `terraform apply` from [terraform/azure](./terraform/azure/).\n\n\u003e It assumes the [az cli](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) tool is properly installed and configured\n\n```bash\ncd terraform/azure || return 1\nterraform init \u0026\u0026 terraform apply\nexport APP_ID=$(cat ./terraform.tfstate | jq '.resources | .[] | select(.type==\"azuread_application\") | .instances[0].attributes.application_id' --raw-output)\nexport APP_PASSWORD=$(cat ./terraform.tfstate | jq '.resources | .[] | select(.type==\"azuread_application_password\") | .instances[0].attributes.value' --raw-output)\n# Generate the Secret with credentials\nkubectl create secret generic azure-credentials --namespace cred --from-literal=clientid=$APP_ID --from-literal=clientsecret=$APP_PASSWORD\n\nexport VAULT_URL=$(cat ./terraform.tfstate | jq '.resources | .[] | select(.type==\"azurerm_key_vault\") | .instances[0].attributes.vault_uri' --raw-output)\nexport TENANT_ID=$(cat ./terraform.tfstate | jq '.resources | .[] | select(.type==\"azurerm_client_config\") | .instances[0].attributes.tenant_id' --raw-output)\n# Generate the ClusterSecretStore\neval \"echo \\\"$(cat ../../ClusterSecretStores/azure-key-vault/azure_secretstore.template.yaml)\\\"\" | kubectl apply -f -\n```\n\n### Kubernetes\n\nI'm also using Terraform to deploy the Roles, RoleBinding and ServiceAccount needed to use the Kubernetes provider. In this example I'm creating a namespace called `remote-cluster` from which I want to sync some csecrets to my eso-demo namespace. In this example the remotes namespace acts as another cluster.\n\nSo again, follow this steps to apply the infra and create the ClusterSecretStore for Kubernetes.\n\n```bash\ncd terraform/k8s || return 1\nterraform init \u0026\u0026 terraform apply\nexport CLUSTER_IP=$(minikube ip)\neval \"echo \\\"$(cat ../../ClusterSecretStores/kubernetes/k8s-secretstore.template.yaml)\\\"\" | kubectl apply -f -\n```\n\n## Demo 1\n\nFor the first demo I'm going to apply all the ExternalSecrets I have in the [ExternalSecrets](./ExternalSecrets/) folder and I'll use the azure provider. That means that every `ExternalSecret` will have the `azure-secret-store` `ClusterSecretStore` as the `secretStoreRef`.\n\nTo simply the application and edition of the files, there's a tiny script at the root of this repo called [apply.sh](./apply.sh) that will 'kubectl apply' every ExternalSecret with the provider sent by parameter. \n\nSo, in my case\n```bash \n./apply.sh azure\n```\nWe can now seee that every ExternalSecret has been applied and their status is SecretSynced\n```bash\n❯ k get externalsecret\nNAME                     STORE                REFRESH INTERVAL   STATUS         READY\ndata-by-name             azure-secret-store   15s                SecretSynced   True\ndata-fetch-tags          azure-secret-store   15s                SecretSynced   True\ndatafrom-fetch-tags      azure-secret-store   15s                SecretSynced   True\ndatafrom-find-by-regex   azure-secret-store   15s                SecretSynced   True\ndatafrom-find-by-tags    azure-secret-store   15s                SecretSynced   True\n```\n\nSo, what does `SecretSynced` mean? It means that ESO synced that ExternalSecret and created a `Secret` in my namespace.\n\n```bash\n❯ k get secret                 \nNAME                     TYPE     DATA   AGE\ndata-by-name             Opaque   1      51m\ndata-fetch-tags          Opaque   1      51m\ndatafrom-fetch-tags      Opaque   3      49m\ndatafrom-find-by-regex   Opaque   2      51m\ndatafrom-find-by-tags    Opaque   2      51m\n```\n\nLet's take a look at one of them (data-by-name)\n```bash\n❯ k get secret data-by-name -ojsonpath='{.data.secret-value}' | base64 -d\nHello from Azure Key Vault%    \n```\n\n## Demo 2\n\nLet's now change the provider for that `ExternalSecret` (data-by-name)\n```bash\nk edit ExternalSecret data-by-name\n```\nand let's see the content again\n```bash\n❯ k get secret data-by-name -ojsonpath='{.data.secret-value}' | base64 -d\nHello from AWS Secret Manager%   \n```\n\nFeel free to play around and change the name of the `ClusterSecretStore` for the different `ExternalSecrets`. Keep in mind the valis values are\n```bash\n❯ k get clustersecretstore\nNAME                 AGE   STATUS   CAPABILITIES   READY\nawsps-secret-store   23m   Valid    ReadWrite      True\nawssm-secret-store   23m   Valid    ReadWrite      True\nazure-secret-store   16m   Valid    ReadWrite      True\nk8s-secret-store     13m   Valid    ReadOnly       True\nvault-secret-store   87m   Valid    ReadWrite      True\n```\n\n## Demo 3\n\nThis is something new in the ESO. We now have the poribility to PUSH a secret to an external provider. \nIn order to do that we're going to apply a new `Secret` that I want to push, and a `PushSecret` that will push it... take a look at [this file](./PushSecrets/data-by-name.yaml)\n\n```bash \n❯ k apply -f ./PushSecrets/data-by-name.yaml \npushsecret.external-secrets.io/data-by-name created\nsecret/my-own-secret created\n```\n\nWe now have a new `Secret` called _my-own-secret_, that one was created by us, and there's a `PushSecret` that's configured to PUSH that `Secret` using the _vault-secret-store_ `ClusterSecretStore`.\n\nSo if you now go in your browser (or your Vault cli tool) to your Vault, you'll find a new secret called _my-pushed-scret_ with the value from the _my-own-secret_ `Secret`\n\n## Demo 4\n\nWe can also use an `ExternalSecret` to create a `Secret` from a generated secret from different Generators. Generators can be Azure Container Registry (ACRAccessToken), AWS Elastic Container Registry (ECRAuthorizationToken), Google Container Registry (GCRAccessToken), Vault Dynamic Secret (VaultDynamicSecret), Password and Fake. \n\nFor this demo we'll generate a `Password` and a `Fake`\n\n```bash\n❯ k apply -f Generators/ \nfake.generators.external-secrets.io/fake-key created\nexternalsecret.external-secrets.io/fake created\npassword.generators.external-secrets.io/my-password created\nexternalsecret.external-secrets.io/my-password created\n```\n\nWe now have two `Secret` _fake_ and _my-password_. \n```bash\n❯ k get secret\nNAME          TYPE     DATA   AGE\nfake          Opaque   2      22s\nmy-password   Opaque   1      22s\n```\n\n_fake_ has the same keys defined in the `Fake`, while _my-password_ has a single key called password with a random generated password based on the spec.\n\n## Clean up\n\n- Delete all the `ExternalSecrets` \n```bash\n❯ k delete -f ExternalSecrets\nexternalsecret.external-secrets.io \"data-by-name\" deleted\nexternalsecret.external-secrets.io \"data-fetch-tags\" deleted\nexternalsecret.external-secrets.io \"datafrom-fetch-tags\" deleted\nexternalsecret.external-secrets.io \"datafrom-find-by-regex\" deleted\nexternalsecret.external-secrets.io \"datafrom-find-by-tags\" deleted\n```\n\n- Delete the `PushSecret`\n```bash\n❯ k delete -f PushSecrets/\npushsecret.external-secrets.io \"data-by-name\" deleted\nsecret \"my-own-secret\" deleted\n```\n\n- Delete the `ClusterSecretStore`\n```bash\n❯ k delete clustersecretstore --all\nclustersecretstore.external-secrets.io \"awsps-secret-store\" deleted\nclustersecretstore.external-secrets.io \"awssm-secret-store\" deleted\nclustersecretstore.external-secrets.io \"azure-secret-store\" deleted\nclustersecretstore.external-secrets.io \"k8s-secret-store\" deleted\nclustersecretstore.external-secrets.io \"vault-secret-store\" deleted\n```\n\n- Delete the generators\n```bash\n❯ k delete -f Generators/\nfake.generators.external-secrets.io \"fake-key\" deleted\nexternalsecret.external-secrets.io \"fake\" deleted\npassword.generators.external-secrets.io \"my-password\" deleted\nexternalsecret.external-secrets.io \"my-password\" deleted\n```\n\n- Terraform destroy every provider you spung up\n\n- Delete the _eso-demo_, _cred_ and _remote-cluster_ namespaces.\n```bash\n❯ k delete ns remote-cluster eso-demo cred\nnamespace \"remote-cluster\" deleted\nnamespace \"eso-demo\" deleted\nnamespace \"cred\" deleted\n```\n\nLet me know if you have comments and/or feedback. \nPRs are always welcome\n\n\n\u003e This repo, and all its content and demos are \"works on my machine\" certified 👍\n\n![](./res/works.png)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsebagomez%2Feso-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsebagomez%2Feso-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsebagomez%2Feso-demo/lists"}