diff --git a/charts/postgres-operator/crds/operatorconfigurations.yaml b/charts/postgres-operator/crds/operatorconfigurations.yaml
index ffcef7b4a..793219019 100644
--- a/charts/postgres-operator/crds/operatorconfigurations.yaml
+++ b/charts/postgres-operator/crds/operatorconfigurations.yaml
@@ -131,6 +131,26 @@ spec:
                   type: boolean
                 infrastructure_roles_secret_name:
                   type: string
+                infrastructure_roles_secrets:
+                  type: array
+                  nullable: true
+                  items:
+                    type: object
+                    required:
+                      - secretname
+                    properties:
+                      secretname:
+                        type: string
+                      name:
+                        type: string
+                      password:
+                        type: string
+                      role:
+                        type: string
+                      details:
+                        type: string
+                      template:
+                        type: boolean
                 inherited_labels:
                   type: array
                   items:
diff --git a/docs/reference/operator_parameters.md b/docs/reference/operator_parameters.md
index 7e5196d56..264c0b559 100644
--- a/docs/reference/operator_parameters.md
+++ b/docs/reference/operator_parameters.md
@@ -252,8 +252,15 @@ configuration they are grouped under the `kubernetes` key.
   teams API. The default is `postgresql-operator`.
 
 * **infrastructure_roles_secret_name**
-  namespaced name of the secret containing infrastructure roles names and
-  passwords.
+  *deprecated*: namespaced name of the secret containing infrastructure roles
+  names and passwords.
+
+* **infrastructure_roles_secrets**
+  array of infrastructure role definitions which reference existing secrets
+  and specify the keys for extract credentials from them such as user name,
+  password and role membership. For the configmap this has to be a string
+  which allows referencing only one infrastructure roles secret.
+  The default is empty.
 
 * **pod_role_label**
   name of the label assigned to the Postgres pods (and services/endpoints) by
diff --git a/manifests/operatorconfiguration.crd.yaml b/manifests/operatorconfiguration.crd.yaml
index 346eabb4a..8dafd63b0 100644
--- a/manifests/operatorconfiguration.crd.yaml
+++ b/manifests/operatorconfiguration.crd.yaml
@@ -127,6 +127,26 @@ spec:
                   type: boolean
                 infrastructure_roles_secret_name:
                   type: string
+                infrastructure_roles_secrets:
+                  type: array
+                  nullable: true
+                  items:
+                    type: object
+                    required:
+                      - secretname
+                    properties:
+                      secretname:
+                        type: string
+                      name:
+                        type: string
+                      password:
+                        type: string
+                      role:
+                        type: string
+                      details:
+                        type: string
+                      template:
+                        type: boolean
                 inherited_labels:
                   type: array
                   items:
diff --git a/pkg/apis/acid.zalan.do/v1/crds.go b/pkg/apis/acid.zalan.do/v1/crds.go
index bc38d6dfd..eac34579a 100644
--- a/pkg/apis/acid.zalan.do/v1/crds.go
+++ b/pkg/apis/acid.zalan.do/v1/crds.go
@@ -911,6 +911,35 @@ var OperatorConfigCRDResourceValidation = apiextv1beta1.CustomResourceValidation
 							"infrastructure_roles_secret_name": {
 								Type: "string",
 							},
+							"infrastructure_roles_secrets": {
+								Type: "array",
+								Items: &apiextv1beta1.JSONSchemaPropsOrArray{
+									Schema: &apiextv1beta1.JSONSchemaProps{
+										Type:     "object",
+										Required: []string{"secretname"},
+										Properties: map[string]apiextv1beta1.JSONSchemaProps{
+											"secretname": {
+												Type: "string",
+											},
+											"name": {
+												Type: "string",
+											},
+											"password": {
+												Type: "string",
+											},
+											"role": {
+												Type: "string",
+											},
+											"details": {
+												Type: "string",
+											},
+											"template": {
+												Type: "boolean",
+											},
+										},
+									},
+								},
+							},
 							"inherited_labels": {
 								Type: "array",
 								Items: &apiextv1beta1.JSONSchemaPropsOrArray{
@@ -980,7 +1009,7 @@ var OperatorConfigCRDResourceValidation = apiextv1beta1.CustomResourceValidation
 							"spilo_privileged": {
 								Type: "boolean",
 							},
-                                                      "storage_resize_mode": {
+							"storage_resize_mode": {
 								Type: "string",
 								Enum: []apiextv1beta1.JSON{
 									{