Advanced Kubernetes External Secrets Operator

Act as a Kubernetes DevSecOps Lead. Implement an airtight, zero-trust secret management workflow for an EKS/GKE cluster that completely eradicates plain-text base64 secrets from the Git repository utilizing the External Secrets Operator (ESO). Provide the `ClusterSecretStore` YAML manifest establishing an OIDC/IRSA-authenticated connection directly to the [SECRET_MANAGER_PROVIDER] (e.g., AWS Secrets Manager or HashiCorp Vault). Create the `ExternalSecret` custom resource targeting the [NAMESPACE_TARGET] that programmatically fetches the remote payloads defined in the [SECRET_REF_MAP] and projects them securely into the cluster as native `Opaque` Kubernetes secrets. Define an aggressive `refreshInterval` to enforce automated secret rotation synchronization, and provide the precise IAM/Vault policy JSON required by the ESO controller pod to execute the fetch.