Q: Your developers frequently hardcode credentials or struggle with complex HashiCorp Vault Agent sidecar annotations that double memory overhead. How do you architect a seamless, self-service secret synchronization layer using External Secrets Operator (ESO) with automated rotation?

Configure a central `ClusterSecretStore` using AWS IAM Roles for Service Accounts (IRSA). Developers do not need cloud credentials; they reference the pre-configured store.

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: aws-secrets-manager
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: eso-controller-sa
            namespace: external-secrets

Provide a simple Golden Path template allowing developers to sync secrets into their namespace without platform intervention.

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
  namespace: team-billing
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: billing-api-secrets
  data:
    - secretKey: STRIPE_API_KEY
      remoteRef:
        key: prod/billing/stripe
        property: api_key

Install Reloader (`stakater/reloader`) or configure ESO's webhook triggers. When a secret rotates in AWS Secrets Manager, ESO updates the Kubernetes Secret, and Reloader triggers a rolling deployment without downtime.