Sync secrets from external sources to ngrok with Kubernetes External Secrets | ngrok blog

Sync secrets from external sources to ngrok with Kubernetes External Secrets | ngrok blog

The External Secrets Operator ( ESO )—a Kubernetes controller for synchronizing secrets with external stores—now integrates with ngrok Vaults and Secrets for Traffic Policy .

If you manage secrets as part of your infrastructure today, chances are they already live in a platform like HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager. With a one-time ESO setup, your existing store remains the source of truth and ESO mirrors the required keys into ngrok Vaults on a schedule.

This is how we run things inside of ngrok: We wire ESO once per cluster, map the keys we need, and let the controller reconcile changes so traffic policies always reference the most up-to-date values. Our ops team is happy because rotation, access, and audit live in one place—no parallel inventories or hand-copied values—while our security team gets clean, controlled propagation across environments without sprawl or consistency issues.

To get started, store your ngrok API key in a Kubernetes secret:

Create a SecretStore that connects to ngrok’s API:

We suggest updating the vault.name to configure your SecretStore with a meaningful name for your environment.

To sync a Kubernetes secret with ngrok, create a PushSecret resource.

Optionally decorate your ngrok secrets with descriptions and custom metadata:

Check out the docs on Traffic Policy Secrets to learn how to create vaults, store secrets, and use them in your policies.

Plus other resources to help you get started: