helm-external-secrets/docs/snippets/cloak-external-secret.yaml

# Access a secret
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: cloak-example
spec:
  refreshInterval: "15m"
  secretStoreRef:
    name: cloak-backend
    kind: SecretStore
  target:
    name: example-sync
  data:
  - secretKey: access-token
    remoteRef:
      key: PULUMI_ACCESS_TOKEN
  - secretKey: do-access-token
    remoteRef:
      key: DIGITALOCEAN_ACCESS_TOKEN