# External Secrets Operator (/docs/runtime/components/external-secrets)



Component Category [#component-category]

Access and security / secret management

Component Description [#component-description]

External Secrets Operator (ESO) reads secret data from external providers (cloud key vaults, HashiCorp Vault, AWS Secrets Manager, and others) and creates native Kubernetes `Secret` resources. It uses `ExternalSecret` and `SecretStore` custom resources to define what to sync and where from.

Why It Is Used [#why-it-is-used]

In BullSequana AI, External Secrets Operator allows the platform to integrate with external secret management systems already in use by the organization. This avoids duplicating secret material across systems and supports enterprise secret governance policies without requiring changes to how platform components consume secrets.

Learn More [#learn-more]

* [External Secrets Operator documentation](https://external-secrets.io/)
* [external-secrets/external-secrets on GitHub](https://github.com/external-secrets/external-secrets)

Deployment notes [#deployment-notes]

External Secrets Operator deploys into the `external-secrets` namespace at sync wave 12 in the common tier, the last common-tier component. It runs one operator replica and one webhook replica. Webhook TLS is managed by cert-manager. A ClusterSecretStore is created to connect with the OpenBao backend.

Interacts With [#interacts-with]

* `OpenBao`, which serves as the external secret store that ESO syncs from in the current platform configuration.