External Secrets Operator (ESO)

The External Secrets Operator (ESO) is our standard solution for the "Secret Zero" problem. It runs inside the cluster and synchronizes secrets from external APIs (Azure Key Vault, HashiCorp Vault, GitLab CI/CD) into native Kubernetes Secret objects. This decouples the secret management lifecycle from the application deployment lifecycle and allows us to rotate credentials externally.