$ vault kv put secret/dev-1/postgres password=random
======= Metadata =======
Key                Value
---                -----
created_time       2022-06-26T15:37:26.01313574Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            30

$ kubectl get externalsecret
NAME       KEY                     PROPERTY   READY   REASON             MESSAGE
redis      secret/dev-1/redis      password   True    SecretSynced       Secret was synced
postgres   secret/dev-1/postgres   password   False   SecretSyncedError  Could not get secret data from provider

./controller.sh

#! /bin/bash

kubectl get externalsecret --watch -ojson \
  | jq 'select(.status.conditions[]?.reason == "SecretSyncedError")' --unbuffered \
  | jq '.spec.data[0].remoteRef' --unbuffered \
  | jq '"\(.key) \(.property)"' -r \
  | while read key property
do
  vault kv put $key $property=somerandomvalue
done

FROM alpine:3.16

# The "setcap -r" is detailed in https://github.com/hashicorp/vault/issues/10924.
RUN tee -a /etc/apk/repositories <<<"@testing http://dl-cdn.alpinelinux.org/alpine/edge/testing" \
    && apk add --update --no-cache bash curl jq kubectl@testing vault libcap \
    && setcap -r /usr/sbin/vault

COPY controller.sh /usr/local/bin/controller.sh
CMD ["controller.sh"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller
spec:
  replicas: 1
  selector:
    matchLabels: {name: controller}
  template:
    metadata:
      labels: {name: controller}
    spec:
      containers:
        - name: controller
          image: controller:local
          imagePullPolicy: Never
          env:
            - name: VAULT_ADDR
              value: http://vault.vault:8200
            - name: VAULT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: vault-token
                  key: vault-token
      serviceAccountName: controller
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: controller
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: controller
subjects:
  - kind: ServiceAccount
    name: controller
roleRef:
  name: external-secrets-reader
  kind: Role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: external-secrets-reader
rules:
  - apiGroups: [external-secrets.io]
    resources: [externalsecrets]
    verbs: [get, list, watch, update, patch]

apiVersion: external-secrets.io/v1beta
kind: ExternalSecret
metadata:
  name: postgres
spec:
  data:
  - remoteRef:
      conversionStrategy: Default
      key: secret/dev-1/postgres
      property: password
    secretKey: password
  refreshInterval: 5s
  secretStoreRef:
    name: vault-backend
  target:
    name: postgres
status:
  conditions:
  - type: Ready
    status: False
    reason: SecretSyncedError
    message: Secret key was not found
  - type: Created
    status: False
    reason: VaultConnError
    message: Vault returned 403 unauthorized