diff --git a/infra/crossplane/templates/secrets.yml b/infra/crossplane/templates/secrets.yml
new file mode 100644
index 0000000..8e01ca5
--- /dev/null
+++ b/infra/crossplane/templates/secrets.yml
@@ -0,0 +1,29 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: proxmox-secret
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: db-pass
+  data:
+    - secretKey: pm_api_url
+      remoteRef:
+        key: kv/crossplane/proxmox
+        property: pm_api_url
+    - secretKey: pm_password
+      remoteRef:
+        key: kv/crossplane/proxmox
+        property: pm_password
+    - secretKey: pm_user
+      remoteRef:
+        key: kv/crossplane/proxmox
+        property: pm_user
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault