apiVersion: v1
kind: Secret
metadata: 
  name: test-secret-k8s
type: Opaque
data: 
  password: {{ "test-password" | b64enc | quote }}

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws
spec:
  provider:
    aws:
      service: SecretsManager
      role: sample-role
      region: us-east-2

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: test-push-secret # Customisable
  namespace: test # Same of the SecretStores
spec:
  updatePolicy: IfNotExists
  refreshInterval: 10s # Refresh interval for which push secret will reconcile
  secretStoreRefs: # A list of secret stores to push secrets to
    - name: aws
      kind: SecretStore
  selector:
    secret:
      name: test-secret-k8s # Source Kubernetes secret to be pushed
  data:
    - conversionStrategy: None
      match: # Source Kubernetes secret key to be pushed
        secretKey: password
        remoteRef:
          remoteKey: test-secret # Remote reference (where the secret is going to be pushed)
          property: password
      metadata:
        secretPushFormat: string