Vault

HashiCorp Vault OSS doesn't support auto-unseal without a KMS. The workaround: a polling sidecar that reads unseal keys from a Kubernetes Secret and runs vault operator unseal every 5 seconds. The trade-offs, the security boundary, and the seal window.

Vault is the trust root every ExternalSecret reads from. Its namespace had zero NetworkPolicies — any pod in the cluster could reach it. The investigation also uncovered a class of ArgoCD drift that silently ignores merged changes.