Deploy on Managed Kubernetes
Files under infra/helm/caracal/examples demonstrate External Secrets Operator and Helm interfaces. They are templates, not complete or certified AWS, Azure, or Google Cloud deployments.
Prerequisites
Section titled “Prerequisites”Operate Kubernetes 1.30+, Postgres, Redis with Streams, External Secrets Operator, a TLS issuer, ingress controller, and Prometheus Operator when using chart monitoring resources.
Procedure
Section titled “Procedure”- Adapt one
external-secrets/secretstore-*.yaml; replace every identity and store reference. - Store every value referenced by
externalsecret-runtime.yamlin the provider secret manager. - Apply the adapted SecretStore and ExternalSecret.
- Copy
values.cloud-managed.yaml; replace hosts, domains, storage class, ingress class, issuer, and egress selectors. - Render. Reject plaintext Secret data, default hosts, broad ingress, and unintended public API, Gateway, or STS endpoints.
- Install the reviewed overlay.
Verify
Section titled “Verify”Confirm Secret synchronization, migration Jobs, pod readiness, HTTPS origins, STS issuer, NetworkPolicy paths, metrics collection, alerts, and a canary protected call with audit evidence.
Rollback and Recovery
Section titled “Rollback and Recovery”Retain the previous Helm revision and values. Roll back only when schema-compatible. Use provider-native storage recovery and restore runtime secrets separately; examples do not create or test backups.
Next Step
Section titled “Next Step”Apply Harden Production before admitting traffic.