_actually_ add the creds

flux/cluster/apps/test/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - ingress.yaml
   - service.yaml
+  - vault-secret-store.yaml

flux/cluster/apps/test/vault-secret-store.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault
+  namespace: test
+spec:
+  provider:
+    vault:
+      server: "https://vault.asraphiel.dev"
+      path: "k8s"
+      version: "v2"
+      auth:
+        # VaultAppRole authenticates with Vault using the
+        # App Role auth mechanism
+        # https://www.vaultproject.io/docs/auth/approle
+        appRole:
+          # Path where the App Role authentication backend is mounted
+          path: "approle"
+          # RoleID configured in the App Role authentication backend
+          roleId: "48a0e39d-e7e8-4ac2-529c-db99ffa1f6b0"
+          # Reference to a key in a K8 Secret that contains the App Role SecretId
+          # (not commited in git)
+          secretRef:
+            name: "vault-secret-id"
+            namespace: "external-secrets"
+            key: "secret-id"