Pulumi ESC vs External Secrets Operator
Pulumi ESC
Pulumi ESC (Environments, Secrets, Configuration) is a secrets and configuration platform that lets you compose environments from multiple secret sources (AWS, Vault, Doppler, 1Password) and expose them as environment variables, files, or direct SDK calls. ESC is tightly integrated with Pulumi's infrastructure-as-code platform but works as a standalone tool too.
Pros
- Sits cleanly on top of existing secrets stores. No migration needed
- Composition model makes multi-cloud environments simple
- Strong fit if you already use Pulumi for IaC
- OIDC-based auth eliminates static Pulumi tokens
Things to check
- Newer product; smaller community than Doppler/Infisical
- Best value only realized if you adopt Pulumi IaC too
- Per-user pricing at the Team tier is steep
- No self-hosted option
Pricing: Free tier (Pulumi Cloud Individual, $0); ESC metered per secret from $0.50/secret/mo (Team) and $0.75/secret/mo (Enterprise), on top of base tiers Team $40/mo and Enterprise $400/mo
External Secrets Operator
External Secrets Operator (ESO) is a Kubernetes operator that syncs secrets from external stores (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, Azure Key Vault, 1Password, and many more) into native Kubernetes Secrets. It is the de facto standard for integrating external secret backends with Kubernetes workloads, with broad community adoption and graduated CNCF status.
Pros
- Massive community adoption; de facto standard for K8s + external secrets
- Broad provider support (30+ backends)
- Free and open source with no license cost
- Works cleanly with GitOps workflows
Things to check
- You still need a real secrets backend (Vault, AWS, etc.) for it to sync from
- Operator deployment adds cluster complexity
- No UI; all configuration is CRD-based
- Cluster admin required to install the CRDs
Pricing: Free (open source)