External Secrets Operator is an open-source Kubernetes operator that reads secrets from external secret stores and writes them into native Kubernetes Secrets. It connects to systems such as AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, Azure Key Vault and CyberArk, so applications keep using standard Kubernetes secrets while the master copy stays in a dedicated vault. The operator runs inside the cluster and is published as open source on GitHub. It complements the cloud secret managers it reads from rather than replacing them.
External Secrets Operator is licensed under the Apache License and was accepted as an early-stage project in the CNCF Sandbox in 2022. The Cloud Native Computing Foundation is based in the United States, and the project does not describe a hosted service of its own. Secrets remain in the stores the organisation chooses, so the jurisdictional exposure depends on those stores. A European organisation can connect the operator to a vault hosted in the EU, which keeps the master copy of its secrets under European control.