diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml
new file mode 100644
index 0000000..a78c6b3
--- /dev/null
+++ b/infra/argocd/templates/external-secrets.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: main
+    path: infra/external-secrets
+  destination:
+    namespace: external-secrets
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true  
+    syncOptions:
+      - CreateNamespace=true 
+
diff --git a/infra/external-secrets/Chart.yaml b/infra/external-secrets/Chart.yaml
new file mode 100644
index 0000000..d89a403
--- /dev/null
+++ b/infra/external-secrets/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: external-secrets
+description: A Helm chart for Kubernetes
+type: application
+version: 0.0.1
+appVersion: 0.0.1
+
+dependencies:
+- name: external-secrets
+  repository: https://charts.external-secrets.io
+  version: 0.13.0
diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml
new file mode 100644
index 0000000..a720adb
--- /dev/null
+++ b/infra/external-secrets/values.yaml
@@ -0,0 +1,463 @@
+external-secrets:
+  replicaCount: 3
+
+  # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+  revisionHistoryLimit: 10
+
+  image:
+    repository: ghcr.io/external-secrets/external-secrets
+    pullPolicy: Always
+    # -- The image tag to use. The default is the chart appVersion.
+    # There are different image flavours available, like distroless and ubi.
+    # Please see GitHub release notes for image tags for these flavors.
+    # By default the distroless image is used.
+    tag: ""
+
+  # -- If set, install and upgrade CRDs through helm chart.
+  installCRDs: true
+
+  crds:
+    # -- If true, create CRDs for Cluster External Secret.
+    createClusterExternalSecret: true
+    # -- If true, create CRDs for Cluster Secret Store.
+    createClusterSecretStore: true
+    # -- If true, create CRDs for Push Secret.
+    createPushSecret: true
+    annotations: {}
+    conversion:
+      enabled: true
+
+  imagePullSecrets: []
+  nameOverride: ""
+  fullnameOverride: ""
+
+  # -- If true, external-secrets will perform leader election between instances to ensure no more
+  # than one instance of external-secrets operates at a time.
+  leaderElect: true
+
+  # -- If set external secrets will filter matching
+  # Secret Stores with the appropriate controller values.
+  controllerClass: ""
+
+  # -- If true external secrets will use recommended kubernetes
+  # annotations as prometheus metric labels.
+  extendedMetricLabels: false
+
+  # -- If set external secrets are only reconciled in the
+  # provided namespace
+  scopedNamespace: ""
+
+  # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace
+  # and implicitly disable cluster stores and cluster external secrets
+  scopedRBAC: false
+
+  # -- if true, the operator will process cluster external secret. Else, it will ignore them.
+  processClusterExternalSecret: true
+
+  # -- if true, the operator will process cluster store. Else, it will ignore them.
+  processClusterStore: true
+
+  # -- Specifies whether an external secret operator deployment be created.
+  createOperator: true
+
+  # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at
+  # a time.
+  concurrent: 1
+
+  serviceAccount:
+    # -- Specifies whether a service account should be created.
+    create: true
+    # -- Automounts the service account token in all containers of the pod
+    automount: true
+    # -- Annotations to add to the service account.
+    annotations: {}
+    # -- Extra Labels to add to the service account.
+    extraLabels: {}
+    # -- The name of the service account to use.
+    # If not set and create is true, a name is generated using the fullname template.
+    name: ""
+
+  rbac:
+    # -- Specifies whether role and rolebinding resources should be created.
+    create: true
+
+  ## -- Extra environment variables to add to container.
+  extraEnv: []
+
+  ## -- Map of extra arguments to pass to container.
+  extraArgs: {}
+
+  ## -- Extra volumes to pass to pod.
+  extraVolumes: []
+
+  ## -- Extra volumes to mount to the container.
+  extraVolumeMounts: []
+
+  ## -- Extra containers to add to the pod.
+  extraContainers: []
+
+  # -- Annotations to add to Deployment
+  deploymentAnnotations: {}
+
+  # -- Annotations to add to Pod
+  podAnnotations: {}
+
+  podLabels: {}
+
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: RuntimeDefault
+
+  resources: {}
+    # requests:
+    #   cpu: 10m
+    #   memory: 32Mi
+
+  prometheus:
+    # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead.
+    enabled: false
+    service:
+      # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead.
+      port: 8080
+
+  serviceMonitor:
+    # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
+    enabled: false
+
+    # -- namespace where you want to install ServiceMonitors
+    namespace: ""
+
+    # -- Additional labels
+    additionalLabels: {}
+
+    # --  Interval to scrape metrics
+    interval: 30s
+
+    # -- Timeout if metrics can't be retrieved in given time interval
+    scrapeTimeout: 25s
+
+    # -- Let prometheus add an exported_ prefix to conflicting labels
+    honorLabels: false
+
+    # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)
+    metricRelabelings: []
+    # - action: replace
+    #   regex: (.*)
+    #   replacement: $1
+    #   sourceLabels:
+    #   - exported_namespace
+    #   targetLabel: namespace
+
+    # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)
+    relabelings: []
+    # - sourceLabels: [__meta_kubernetes_pod_node_name]
+    #   separator: ;
+    #   regex: ^(.*)$
+    #   targetLabel: nodename
+    #   replacement: $1
+    #   action: replace
+
+  metrics:
+    service:
+      # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+      enabled: false
+
+      # -- Metrics service port to scrape
+      port: 8080
+
+      # -- Additional service annotations
+      annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # -- Pod priority class name.
+  priorityClassName: ""
+
+  # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+  podDisruptionBudget:
+    enabled: false
+    minAvailable: 1
+    # maxUnavailable: 1
+
+  # -- Run the controller on the host network
+  hostNetwork: false
+
+  webhook:
+    # -- Specifies whether a webhook deployment be created.
+    create: true
+    # -- Specifices the time to check if the cert is valid
+    certCheckInterval: "5m"
+    # -- Specifices the lookaheadInterval for certificate validity
+    lookaheadInterval: ""
+    replicaCount: 1
+
+    # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+    revisionHistoryLimit: 10
+
+    certDir: /tmp/certs
+    # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
+    failurePolicy: Fail
+    # -- Specifies if webhook pod should use hostNetwork or not.
+    hostNetwork: false
+    image:
+      repository: ghcr.io/external-secrets/external-secrets
+      pullPolicy: IfNotPresent
+    # -- The image tag to use. The default is the chart appVersion.
+      tag: ""
+    imagePullSecrets: []
+    nameOverride: ""
+    fullnameOverride: ""
+    # -- The port the webhook will listen to
+    port: 10250
+    rbac:
+    # -- Specifies whether role and rolebinding resources should be created.
+      create: true
+    serviceAccount:
+      # -- Specifies whether a service account should be created.
+      create: true
+      # -- Automounts the service account token in all containers of the pod
+      automount: true
+      # -- Annotations to add to the service account.
+      annotations: {}
+      # -- Extra Labels to add to the service account.
+      extraLabels: {}
+      # -- The name of the service account to use.
+      # If not set and create is true, a name is generated using the fullname template.
+      name: ""
+    nodeSelector: {}
+
+    tolerations: []
+
+    topologySpreadConstraints: []
+
+    affinity: {}
+
+      # -- Pod priority class name.
+    priorityClassName: ""
+
+    # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+    podDisruptionBudget:
+      enabled: false
+      minAvailable: 1
+      # maxUnavailable: 1
+    prometheus:
+      # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead
+      enabled: false
+      service:
+        # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead
+        port: 8080
+
+    serviceMonitor:
+      # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
+      enabled: false
+
+      # -- Additional labels
+      additionalLabels: {}
+
+      # --  Interval to scrape metrics
+      interval: 30s
+
+      # -- Timeout if metrics can't be retrieved in given time interval
+      scrapeTimeout: 25s
+
+    metrics:
+      service:
+        # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+        enabled: false
+
+        # -- Metrics service port to scrape
+        port: 8080
+
+        # -- Additional service annotations
+        annotations: {}
+
+
+    readinessProbe:
+      # -- Address for readiness probe
+      address: ""
+      # -- ReadinessProbe port for kubelet
+      port: 8081
+
+
+      ## -- Extra environment variables to add to container.
+    extraEnv: []
+
+      ## -- Map of extra arguments to pass to container.
+    extraArgs: {}
+
+      ## -- Extra volumes to pass to pod.
+    extraVolumes: []
+
+      ## -- Extra volumes to mount to the container.
+    extraVolumeMounts: []
+
+      # -- Annotations to add to Secret
+    secretAnnotations: {}
+
+      # -- Annotations to add to Deployment
+    deploymentAnnotations: {}
+
+      # -- Annotations to add to Pod
+    podAnnotations: {}
+
+    podLabels: {}
+
+    podSecurityContext: {}
+        # fsGroup: 2000
+
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+
+    resources: {}
+        # requests:
+        #   cpu: 10m
+        #   memory: 32Mi
+
+  certController:
+    # -- Specifies whether a certificate controller deployment be created.
+    create: true
+    requeueInterval: "5m"
+    replicaCount: 1
+
+    # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+    revisionHistoryLimit: 10
+
+    image:
+      repository: ghcr.io/external-secrets/external-secrets
+      pullPolicy: Always
+      tag: ""
+    imagePullSecrets: []
+    nameOverride: ""
+    fullnameOverride: ""
+    rbac:
+    # -- Specifies whether role and rolebinding resources should be created.
+      create: true
+    serviceAccount:
+      # -- Specifies whether a service account should be created.
+      create: true
+      # -- Automounts the service account token in all containers of the pod
+      automount: true
+      # -- Annotations to add to the service account.
+      annotations: {}
+      # -- Extra Labels to add to the service account.
+      extraLabels: {}
+      # -- The name of the service account to use.
+      # If not set and create is true, a name is generated using the fullname template.
+      name: ""
+    nodeSelector: {}
+
+    tolerations: []
+
+    topologySpreadConstraints: []
+
+    affinity: {}
+
+    # -- Run the certController on the host network
+    hostNetwork: false
+
+      # -- Pod priority class name.
+    priorityClassName: ""
+
+    # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+    podDisruptionBudget:
+      enabled: false
+      minAvailable: 1
+      # maxUnavailable: 1
+
+    prometheus:
+      # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead
+      enabled: false
+      service:
+        # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead
+        port: 8080
+
+    serviceMonitor:
+      # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
+      enabled: false
+
+      # -- Additional labels
+      additionalLabels: {}
+
+      # --  Interval to scrape metrics
+      interval: 30s
+
+      # -- Timeout if metrics can't be retrieved in given time interval
+      scrapeTimeout: 25s
+
+    metrics:
+      service:
+        # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+        enabled: false
+
+        # -- Metrics service port to scrape
+        port: 8080
+
+        # -- Additional service annotations
+        annotations: {}
+
+      ## -- Extra environment variables to add to container.
+    extraEnv: []
+
+      ## -- Map of extra arguments to pass to container.
+    extraArgs: {}
+
+
+      ## -- Extra volumes to pass to pod.
+    extraVolumes: []
+
+      ## -- Extra volumes to mount to the container.
+    extraVolumeMounts: []
+
+      # -- Annotations to add to Deployment
+    deploymentAnnotations: {}
+
+      # -- Annotations to add to Pod
+    podAnnotations: {}
+
+    podLabels: {}
+
+    podSecurityContext: {}
+        # fsGroup: 2000
+
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+
+    resources: {}
+        # requests:
+        #   cpu: 10m
+        #   memory: 32Mi
+
+  # -- Specifies `dnsOptions` to deployment
+  dnsConfig: {}