Zero Trust API Security: Vault as an External Secrets Operator

Act as a DevSecOps Lead and API Architect. Seamlessly integrate HashiCorp Vault with an advanced [K8S_OPERATOR] (specifically the External Secrets Operator) to securely manage and distribute API keys and TLS certificates for a massive, high-throughput [API_GATEWAY] (e.g., Kong or Ambassador) operating strictly within a Zero Trust perimeter. Design the automated reconciliation workflow that safely pulls highly encrypted secrets from the central Vault cluster and mathematically projects them into native Kubernetes `Secret` resources at a strict, continuous [SECRET_SYNC_INTERVAL] (e.g., every 5 minutes). You must provide a rigorous technical discussion analyzing the profound security trade-offs of this specific approach (which inherently places plaintext secrets into etcd) versus re-writing the gateway to make direct, synchronous Vault API calls. Provide exact configuration steps to minimize the attack surface of the Kubernetes etcd store utilizing AWS KMS envelope encryption.