Set up secret management for SeekrFlow

SeekrFlow reads every credential from Kubernetes secrets in the seekrflow namespace. You choose how those secrets get there. External Secrets Operator can sync them from a secret store, or you can create them directly in the cluster.

Choose an approach

	External Secrets Operator	Kubernetes secrets
Best for	Production deployments, recommended. Organizations that manage secrets centrally or require rotation.	Simpler deployments with fewer components. The only approach `sfe` automates for on-premises deployments. On-premises, you can also use External Secrets Operator with a compatible store, such as HashiCorp Vault.
Where values live	Your cloud secret store, synced into the cluster.	The cluster only.
Rotation	Synced from the store automatically.	Manual.
What you install	External Secrets Operator and a secret store. SeekrFlow does not install External Secrets Operator for you.	Nothing.
Supported stores	AWS Secrets Manager, AWS Systems Manager Parameter Store, and HashiCorp Vault.	Not applicable.
Populated by `sfe secrets create`	AWS Secrets Manager and AWS Systems Manager Parameter Store. For HashiCorp Vault, you write the values yourself.	Yes.
Setup	Install External Secrets Operator and connect your store, on this page.	Nothing until configuration.

With either approach, you create the secrets after you generate your values file. See Create SeekrFlow secrets.

With Kubernetes secrets, the cluster holds the only copy of every credential, including keys that must stay stable for the life of the deployment. Losing the cluster without a copy of those keys forces users to enroll in multi-factor authentication again and ends every active session. See Create SeekrFlow secrets.

If you choose Kubernetes secrets, there’s nothing more to set up now. Continue to Collect credentials and values.

Install External Secrets Operator

External Secrets Operator syncs secrets from your cloud secret store into Kubernetes secrets in the seekrflow namespace. SeekrFlow creates the sync resources for each secret, but it does not install External Secrets Operator. It must be running before you install SeekrFlow. Install it from its upstream Helm chart, into its own namespace:

helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace

Keep the release name and namespace external-secrets. sfe cloud-identity aws associates SeekrFlow’s role with that service account. For other installation options, see the External Secrets Operator documentation.

Connect your secret store

SeekrFlow supports these stores:

AWS Secrets Manager
AWS Systems Manager Parameter Store
HashiCorp Vault

External Secrets Operator reads from the store with SeekrFlow’s role, which grants read access to seekrflow/* secrets. See Set up cloud identity. With Amazon Elastic Kubernetes Service (Amazon EKS) Pod Identity, sfe cloud-identity aws creates the association for External Secrets Operator’s service account during configuration. With AWS Identity and Access Management (IAM) roles for service accounts, annotate that service account through External Secrets Operator’s own Helm values. With HashiCorp Vault, you write SeekrFlow’s secret values to the store yourself. sfe preflight can’t verify what’s in a Vault store.

Record the values

If you use External Secrets Operator, note these values. You will enter them when you create the values file.

Value	Used for	Example or format
Create the secret store	`global.Secrets.store.create`	`true`
Secret store provider	`global.Secrets.store.provider`	On AWS, the service and Region, such as `aws: {service: SecretsManager, region: us-east-1}`. For HashiCorp Vault, the server address and authentication.

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference

Set up secret management for SeekrFlow

Choose an approach

Install External Secrets Operator

Connect your secret store

Record the values

​Choose an approach

​Install External Secrets Operator

​Connect your secret store

​Record the values

Choose an approach

Install External Secrets Operator

Connect your secret store

Record the values