The External Secrets Operator ( ESO )—a Kubernetes controller for synchronizing secrets with external stores—now integrates with ngrok Vaults and Secrets for Traffic Policy .
If you manage secrets as part of your infrastructure today, chances are they already live in a platform like HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager. With a one-time ESO setup, your existing store remains the source of truth and ESO mirrors the required keys into ngrok Vaults on a schedule.
This is how we run things inside of ngrok: We wire ESO once per cluster, map the keys we need, and let the controller reconcile changes so traffic policies always reference the most up-to-date values. Our ops team is happy because rotation, access, and audit live in one place—no parallel inventories or hand-copied values—while our security team gets clean, controlled propagation across environments without sprawl or consistency issues.
To get started, store your ngrok API key in a Kubernetes secret:
Create a SecretStore that connects to ngrok’s API:
We suggest updating the vault.name to configure your SecretStore with a meaningful name for your environment.
To sync a Kubernetes secret with ngrok, create a PushSecret resource.
Optionally decorate your ngrok secrets with descriptions and custom metadata:
Check out the docs on Traffic Policy Secrets to learn how to create vaults, store secrets, and use them in your policies.
Plus other resources to help you get started: