> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up secret management for SeekrFlow

> Choose how SeekrFlow's credentials reach the cluster, and set up External Secrets Operator if you use a secret store.

SeekrFlow reads every credential from Kubernetes secrets in the `seekrflow` namespace. You choose how those secrets get there. External Secrets Operator can sync them from a secret store, or you can create them directly in the cluster.

## Choose an approach

| | External Secrets Operator | Kubernetes secrets |
| - | - | - |
| Best for | Production deployments, recommended. Organizations that manage secrets centrally or require rotation. | Simpler deployments with fewer components. The only approach `sfe` automates for on-premises deployments. On-premises, you can also use External Secrets Operator with a compatible store, such as HashiCorp Vault. |
| Where values live | Your cloud secret store, synced into the cluster. | The cluster only. |
| Rotation | Synced from the store automatically. | Manual. |
| What you install | External Secrets Operator and a secret store. SeekrFlow does not install External Secrets Operator for you. | Nothing. |
| Supported stores | AWS Secrets Manager, AWS Systems Manager Parameter Store, and HashiCorp Vault. | Not applicable. |
| Populated by `sfe secrets create` | AWS Secrets Manager and AWS Systems Manager Parameter Store. For HashiCorp Vault, you write the values yourself. | Yes. |
| Setup | Install External Secrets Operator and connect your store, on this page. | Nothing until configuration. |

With either approach, you create the secrets after you generate your values file. See [Create SeekrFlow secrets](/self-managed/flow/prepare/secrets-and-tokens).

<Warning>
  With Kubernetes secrets, the cluster holds the only copy of every credential, including keys that must stay stable for the life of the deployment. Losing the cluster without a copy of those keys forces users to enroll in multi-factor authentication again and ends every active session. See [Create SeekrFlow secrets](/self-managed/flow/prepare/secrets-and-tokens).
</Warning>

If you choose Kubernetes secrets, there's nothing more to set up now. Continue to [Collect credentials and values](/self-managed/flow/provision/checklist).

## Install External Secrets Operator

External Secrets Operator syncs secrets from your cloud secret store into Kubernetes secrets in the `seekrflow` namespace. SeekrFlow creates the sync resources for each secret, but it does not install External Secrets Operator. It must be running before you install SeekrFlow.

Install it from its upstream Helm chart, into its own namespace:

```bash theme={null}
helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace
```

Keep the release name and namespace `external-secrets`. `sfe cloud-identity aws` associates SeekrFlow's role with that service account. For other installation options, see the [External Secrets Operator documentation](https://external-secrets.io).

## Connect your secret store

SeekrFlow supports these stores:

* AWS Secrets Manager
* AWS Systems Manager Parameter Store
* HashiCorp Vault

External Secrets Operator reads from the store with SeekrFlow's role, which grants read access to `seekrflow/*` secrets. See [Set up cloud identity](/self-managed/flow/provision/cloud-identity). With Amazon Elastic Kubernetes Service (Amazon EKS) Pod Identity, `sfe cloud-identity aws` creates the association for External Secrets Operator's service account during configuration. With AWS Identity and Access Management (IAM) roles for service accounts, annotate that service account through External Secrets Operator's own Helm values.

With HashiCorp Vault, you write SeekrFlow's secret values to the store yourself. `sfe preflight` can't verify what's in a Vault store.

## Record the values

If you use External Secrets Operator, note these values. You will enter them when you create the values file.

| Value | Used for | Example or format |
| - | - | - |
| Create the secret store | `global.Secrets.store.create` | `true` |
| Secret store provider | `global.Secrets.store.provider` | On AWS, the service and Region, such as `aws: {service: SecretsManager, region: us-east-1}`. For HashiCorp Vault, the server address and authentication. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.