Installing the External Secrets Operator in Kubernetes

Install External Secrets Operator for managing secrets from external storage systems on EKS/AKS.

Note:

This step is required only if you want to store sensitive credentials in an external secret-management system.

Important:

By default, Automation Suite includes the External Secrets Operator.

If you choose not to use the bundled version, you can install your own External Secrets Operator instance by following the steps described in this section.

The External Secrets Operator (ESO) is a Kubernetes operator that integrates with external secret management systems (for example, AWS Secrets Manager, HashiCorp Vault). It reads data from external secret backends and automatically creates and synchronizes the values as native Kubernetes Secrets.

Automation Suite supports Azure Key Vault, HashiCorp Vault, and AWS Secrets Manager as external secret providers.

Adding the External Secrets Helm repository

You must add the External Secrets Helm repository to your Helm installation as follows:

helm repo add external-secrets https://charts.external-secrets.io

After adding the repository, you must update your Helm repositories to fetch the latest chart information as follows:

helm repo update

Installing the External Secrets Operator

You must deploy the External Secrets Operator using version v1.16.2 or later. Automation Suite requires External Secrets Operator version v1.16.2 as the minimum supported version, which includes the latest ESO v1 APIs.

Run the following command to install the operator:

helm install external-secrets \
  external-secrets/external-secrets \
  -n external-secrets \
  --create-namespace \
  --version 1.3.1

The External Secrets Operator requires access to the uipath namespace to function properly.

Verifying the installation

After installation, you must verify that the operator pods are running as follows:

kubectl get pods -n external-secrets

You should see output similar to the following example:

NAME                                               READY   STATUS    RESTARTS   AGE
external-secrets-7d8c9b5f9f-abc12                  1/1     Running   0          30s
external-secrets-cert-controller-6d8f7b9c-def34    1/1     Running   0          30s
external-secrets-webhook-8c9d7f6e5-ghi56           1/1     Running   0          30s

If all pods display a Running status, the installation is complete.