diff --git a/apis/release/v1beta1/types.go b/apis/release/v1beta1/types.go
index ea8d415..9322078 100644
--- a/apis/release/v1beta1/types.go
+++ b/apis/release/v1beta1/types.go
@@ -18,6 +18,7 @@ package v1beta1
 
 import (
 	"helm.sh/helm/v3/pkg/release"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 
@@ -85,7 +86,8 @@ type ReleaseObservation struct {
 // A ReleaseSpec defines the desired state of a Release.
 type ReleaseSpec struct {
 	runtimev1alpha1.ResourceSpec `json:",inline"`
-	ForProvider                  ReleaseParameters `json:"forProvider"`
+	ConnectionDetails            []ConnectionDetail `json:"connectionDetails,omitempty"`
+	ForProvider                  ReleaseParameters  `json:"forProvider"`
 	// RollbackRetriesLimit is max number of attempts to retry Helm deployment by rolling back the release.
 	RollbackRetriesLimit *int32 `json:"rollbackLimit,omitempty"`
 }
@@ -99,6 +101,12 @@ type ReleaseStatus struct {
 	Synced                         bool               `json:"synced,omitempty"`
 }
 
+// ConnectionDetail todo
+type ConnectionDetail struct {
+	v1.ObjectReference    `json:",inline"`
+	ToConnectionSecretKey string `json:"toConnectionSecretKey,omitempty"`
+}
+
 // +kubebuilder:object:root=true
 // +kubebuilder:storageversion
 
diff --git a/apis/release/v1beta1/zz_generated.deepcopy.go b/apis/release/v1beta1/zz_generated.deepcopy.go
index 1a3bbbc..0065087 100644
--- a/apis/release/v1beta1/zz_generated.deepcopy.go
+++ b/apis/release/v1beta1/zz_generated.deepcopy.go
@@ -40,6 +40,22 @@ func (in *ChartSpec) DeepCopy() *ChartSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConnectionDetail) DeepCopyInto(out *ConnectionDetail) {
+	*out = *in
+	out.ObjectReference = in.ObjectReference
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConnectionDetail.
+func (in *ConnectionDetail) DeepCopy() *ConnectionDetail {
+	if in == nil {
+		return nil
+	}
+	out := new(ConnectionDetail)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DataKeySelector) DeepCopyInto(out *DataKeySelector) {
 	*out = *in
@@ -173,6 +189,11 @@ func (in *ReleaseParameters) DeepCopy() *ReleaseParameters {
 func (in *ReleaseSpec) DeepCopyInto(out *ReleaseSpec) {
 	*out = *in
 	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	if in.ConnectionDetails != nil {
+		in, out := &in.ConnectionDetails, &out.ConnectionDetails
+		*out = make([]ConnectionDetail, len(*in))
+		copy(*out, *in)
+	}
 	in.ForProvider.DeepCopyInto(&out.ForProvider)
 	if in.RollbackRetriesLimit != nil {
 		in, out := &in.RollbackRetriesLimit, &out.RollbackRetriesLimit
diff --git a/cluster/integration/integration_tests.sh b/cluster/integration/integration_tests.sh
index 1aa3c46..ddfa85f 100755
--- a/cluster/integration/integration_tests.sh
+++ b/cluster/integration/integration_tests.sh
@@ -271,7 +271,7 @@ check_pods 2
 echo_step "installing ${PROJECT_NAME} into \"${CROSSPLANE_NAMESPACE}\" namespace"
 
 INSTALL_YAML="$( cat <<EOF
-apiVersion: pkg.crossplane.io/v1alpha1
+apiVersion: pkg.crossplane.io/v1beta1
 kind: Provider
 metadata:
   name: "${PACKAGE_NAME}"
diff --git a/examples/sample/release.yaml b/examples/sample/release.yaml
index a670e35..65f9214 100644
--- a/examples/sample/release.yaml
+++ b/examples/sample/release.yaml
@@ -31,5 +31,28 @@ spec:
 #         name: svals
 #         namespace: wordpress
 #         optional: false
+#  connectionDetails:
+#    - apiVersion: v1
+#      kind: Service
+#      name: wordpress-example
+#      namespace: wordpress
+#      fieldPath: spec.clusterIP
+#      #fieldPath: status.loadBalancer.ingress[0].ip
+#      toConnectionSecretKey: ip
+#    - apiVersion: v1
+#      kind: Service
+#      name: wordpress-example
+#      namespace: wordpress
+#      fieldPath: spec.ports[0].port
+#      toConnectionSecretKey: port
+#    - apiVersion: v1
+#      kind: Secret
+#      name: wordpress-example
+#      namespace: wordpress
+#      fieldPath: data.wordpress-password
+#      toConnectionSecretKey: password
+#  writeConnectionSecretToRef:
+#    name: wordpress-credentials
+#    namespace: crossplane-system
   providerConfigRef:
     name: helm-provider
diff --git a/package/crds/helm.crossplane.io_releases.yaml b/package/crds/helm.crossplane.io_releases.yaml
index 6418e15..d881f97 100644
--- a/package/crds/helm.crossplane.io_releases.yaml
+++ b/package/crds/helm.crossplane.io_releases.yaml
@@ -360,6 +360,35 @@ spec:
           spec:
             description: A ReleaseSpec defines the desired state of a Release.
             properties:
+              connectionDetails:
+                items:
+                  description: ConnectionDetail todo
+                  properties:
+                    apiVersion:
+                      description: API version of the referent.
+                      type: string
+                    fieldPath:
+                      description: 'If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.'
+                      type: string
+                    kind:
+                      description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+                      type: string
+                    name:
+                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                      type: string
+                    namespace:
+                      description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                      type: string
+                    resourceVersion:
+                      description: 'Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
+                      type: string
+                    toConnectionSecretKey:
+                      type: string
+                    uid:
+                      description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
+                      type: string
+                  type: object
+                type: array
               deletionPolicy:
                 description: DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. The "Delete" policy is the default when no policy is specified.
                 enum:
diff --git a/pkg/controller/release/observe.go b/pkg/controller/release/observe.go
index d88d17f..dc82e9f 100644
--- a/pkg/controller/release/observe.go
+++ b/pkg/controller/release/observe.go
@@ -18,6 +18,15 @@ package release
 
 import (
 	"context"
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
 
 	"github.com/pkg/errors"
 	"helm.sh/helm/v3/pkg/release"
@@ -31,6 +40,7 @@ const (
 	errReleaseInfoNilInObservedRelease = "release info is nil in observed helm release"
 	errChartNilInObservedRelease       = "chart field is nil in observed helm release"
 	errChartMetaNilInObservedRelease   = "chart metadata field is nil in observed helm release"
+	errObjectNotPartOfRelease          = "object is not part of release: %v"
 )
 
 // generateObservation generates release observation for the input release object
@@ -112,3 +122,53 @@ func isUpToDate(ctx context.Context, kube client.Client, in *v1beta1.ReleasePara
 func isPending(s release.Status) bool {
 	return s == release.StatusPendingInstall || s == release.StatusPendingUpgrade || s == release.StatusPendingRollback
 }
+
+func connectionDetails(ctx context.Context, kube client.Client, connDetails []v1beta1.ConnectionDetail, relName, relNamespace string) (managed.ConnectionDetails, error) {
+	mcd := managed.ConnectionDetails{}
+
+	for _, cd := range connDetails {
+		ro := unstructuredFromObjectRef(cd.ObjectReference)
+		if err := kube.Get(ctx, types.NamespacedName{Name: ro.GetName(), Namespace: ro.GetNamespace()}, &ro); err != nil {
+			return mcd, errors.Wrap(err, "cannot get object")
+		}
+
+		// TODO(hasan): consider making this check configurable, i.e. possible to skip via a field in spec
+		if !partOfRelease(ro, relName, relNamespace) {
+			return mcd, errors.Errorf(errObjectNotPartOfRelease, cd.ObjectReference)
+		}
+
+		paved := fieldpath.Pave(ro.Object)
+		v, err := paved.GetValue(cd.FieldPath)
+		if err != nil {
+			return mcd, errors.Wrapf(err, "failed to get value at fieldPath: %s", cd.FieldPath)
+		}
+		s := fmt.Sprintf("%v", v)
+		fv := []byte(s)
+		// prevent secret data being encoded twice
+		if cd.Kind == "Secret" && cd.APIVersion == "v1" && strings.HasPrefix(cd.FieldPath, "data") {
+			fv, err = base64.StdEncoding.DecodeString(s)
+			if err != nil {
+				return mcd, errors.Wrap(err, "failed to decode secret data")
+			}
+		}
+
+		mcd[cd.ToConnectionSecretKey] = fv
+	}
+
+	return mcd, nil
+}
+
+func unstructuredFromObjectRef(r corev1.ObjectReference) unstructured.Unstructured {
+	u := unstructured.Unstructured{}
+	u.SetAPIVersion(r.APIVersion)
+	u.SetKind(r.Kind)
+	u.SetName(r.Name)
+	u.SetNamespace(r.Namespace)
+
+	return u
+}
+
+func partOfRelease(u unstructured.Unstructured, relName, relNamespace string) bool {
+	a := u.GetAnnotations()
+	return a[helmReleaseNameAnnotation] == relName && a[helmReleaseNamespaceAnnotation] == relNamespace
+}
diff --git a/pkg/controller/release/observe_test.go b/pkg/controller/release/observe_test.go
index 16d63a7..f796f8d 100644
--- a/pkg/controller/release/observe_test.go
+++ b/pkg/controller/release/observe_test.go
@@ -4,13 +4,15 @@ import (
 	"context"
 	"testing"
 
-	"k8s.io/apimachinery/pkg/runtime"
-
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
 	"github.com/crossplane/crossplane-runtime/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
 	"helm.sh/helm/v3/pkg/chart"
 	"helm.sh/helm/v3/pkg/release"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/crossplane-contrib/provider-helm/apis/release/v1beta1"
@@ -372,3 +374,117 @@ func Test_isUpToDate(t *testing.T) {
 		})
 	}
 }
+
+func Test_connectionDetails(t *testing.T) {
+	type args struct {
+		kube         client.Client
+		connDetails  []v1beta1.ConnectionDetail
+		relName      string
+		relNamespace string
+	}
+	type want struct {
+		out managed.ConnectionDetails
+		err error
+	}
+	cases := map[string]struct {
+		args
+		want
+	}{
+		"Fail_NotPartOfRelease": {
+			args: args{
+				kube: &test.MockClient{
+					MockGet: func(ctx context.Context, key client.ObjectKey, obj runtime.Object) error {
+						if o, ok := obj.(*unstructured.Unstructured); o.GetKind() == "Secret" && ok && key.Name == testSecretName && key.Namespace == testNamespace {
+							*obj.(*unstructured.Unstructured) = unstructured.Unstructured{
+								Object: map[string]interface{}{
+									"data": map[string]interface{}{
+										"db-password": "MTIzNDU=",
+									},
+								},
+							}
+						}
+						return nil
+					},
+				},
+				connDetails: []v1beta1.ConnectionDetail{
+					{
+						ObjectReference: corev1.ObjectReference{
+							Kind:       "Secret",
+							Namespace:  testNamespace,
+							Name:       testSecretName,
+							APIVersion: "v1",
+							FieldPath:  "data.db-password",
+						},
+						ToConnectionSecretKey: "password",
+					},
+				},
+				relName:      testReleaseName,
+				relNamespace: testNamespace,
+			},
+			want: want{
+				out: managed.ConnectionDetails{},
+				err: errors.Errorf(errObjectNotPartOfRelease, corev1.ObjectReference{
+					Kind:       "Secret",
+					Namespace:  testNamespace,
+					Name:       testSecretName,
+					APIVersion: "v1",
+					FieldPath:  "data.db-password",
+				}),
+			},
+		},
+		"Success_PartOfRelease": {
+			args: args{
+				kube: &test.MockClient{
+					MockGet: func(ctx context.Context, key client.ObjectKey, obj runtime.Object) error {
+						if o, ok := obj.(*unstructured.Unstructured); o.GetKind() == "Secret" && ok && key.Name == testSecretName && key.Namespace == testNamespace {
+							*obj.(*unstructured.Unstructured) = unstructured.Unstructured{
+								Object: map[string]interface{}{
+									"metadata": map[string]interface{}{
+										"annotations": map[string]interface{}{
+											helmReleaseNameAnnotation:      testReleaseName,
+											helmReleaseNamespaceAnnotation: testNamespace,
+										},
+									},
+									"data": map[string]interface{}{
+										"db-password": "MTIzNDU=",
+									},
+								},
+							}
+						}
+						return nil
+					},
+				},
+				connDetails: []v1beta1.ConnectionDetail{
+					{
+						ObjectReference: corev1.ObjectReference{
+							Kind:       "Secret",
+							Namespace:  testNamespace,
+							Name:       testSecretName,
+							APIVersion: "v1",
+							FieldPath:  "data.db-password",
+						},
+						ToConnectionSecretKey: "password",
+					},
+				},
+				relName:      testReleaseName,
+				relNamespace: testNamespace,
+			},
+			want: want{
+				out: managed.ConnectionDetails{
+					"password": []byte("12345"),
+				},
+			},
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			got, gotErr := connectionDetails(context.Background(), tc.args.kube, tc.args.connDetails, tc.args.relName, tc.args.relNamespace)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("connectionDetails(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.out, got); diff != "" {
+				t.Errorf("connectionDetails(...): -want result, +got result: %s", diff)
+			}
+		})
+	}
+}
diff --git a/pkg/controller/release/release.go b/pkg/controller/release/release.go
index f49909e..cf0ca1a 100644
--- a/pkg/controller/release/release.go
+++ b/pkg/controller/release/release.go
@@ -20,6 +20,12 @@ import (
 	"context"
 	"time"
 
+	runtimev1alpha1 "github.com/crossplane/crossplane-runtime/apis/core/v1alpha1"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/pkg/meta"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/pkg/resource"
 	"github.com/pkg/errors"
 	"helm.sh/helm/v3/pkg/chart"
 	"helm.sh/helm/v3/pkg/release"
@@ -31,13 +37,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	ktype "sigs.k8s.io/kustomize/api/types"
 
-	runtimev1alpha1 "github.com/crossplane/crossplane-runtime/apis/core/v1alpha1"
-	"github.com/crossplane/crossplane-runtime/pkg/event"
-	"github.com/crossplane/crossplane-runtime/pkg/logging"
-	"github.com/crossplane/crossplane-runtime/pkg/meta"
-	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
-	"github.com/crossplane/crossplane-runtime/pkg/resource"
-
 	"github.com/crossplane-contrib/provider-helm/apis/release/v1beta1"
 	helmv1beta1 "github.com/crossplane-contrib/provider-helm/apis/v1beta1"
 	"github.com/crossplane-contrib/provider-helm/pkg/clients"
@@ -49,6 +48,9 @@ const (
 
 	resyncPeriod     = 10 * time.Minute
 	reconcileTimeout = 10 * time.Minute
+
+	helmReleaseNameAnnotation      = "meta.helm.sh/release-name"
+	helmReleaseNamespaceAnnotation = "meta.helm.sh/release-namespace"
 )
 
 const (
@@ -235,16 +237,23 @@ func (e *helmExternal) Observe(ctx context.Context, mg resource.Managed) (manage
 		return managed.ExternalObservation{}, errors.Wrap(err, errFailedToCheckIfUpToDate)
 	}
 	cr.Status.Synced = s
+	cd := managed.ConnectionDetails{}
 	if cr.Status.AtProvider.State == release.StatusDeployed && s {
 		cr.Status.Failed = 0
 		cr.Status.SetConditions(runtimev1alpha1.Available())
+
+		cd, err = connectionDetails(ctx, e.kube, cr.Spec.ConnectionDetails, rel.Name, rel.Namespace)
+		if err != nil {
+			return managed.ExternalObservation{}, errors.Wrap(err, "cannot get connection details")
+		}
 	} else {
 		cr.Status.SetConditions(runtimev1alpha1.Unavailable())
 	}
 
 	return managed.ExternalObservation{
-		ResourceExists:   true,
-		ResourceUpToDate: cr.Status.Synced && !(shouldRollBack(cr) && !rollBackLimitReached(cr)),
+		ResourceExists:    true,
+		ResourceUpToDate:  cr.Status.Synced && !(shouldRollBack(cr) && !rollBackLimitReached(cr)),
+		ConnectionDetails: cd,
 	}, nil
 }
 
diff --git a/pkg/controller/release/release_test.go b/pkg/controller/release/release_test.go
index 7f345aa..0ad6374 100644
--- a/pkg/controller/release/release_test.go
+++ b/pkg/controller/release/release_test.go
@@ -492,7 +492,7 @@ func Test_helmExternal_Observe(t *testing.T) {
 				}),
 			},
 			want: want{
-				out: managed.ExternalObservation{ResourceExists: true, ResourceUpToDate: false},
+				out: managed.ExternalObservation{ResourceExists: true, ResourceUpToDate: false, ConnectionDetails: managed.ConnectionDetails{}},
 				err: nil,
 			},
 		},
@@ -518,7 +518,7 @@ func Test_helmExternal_Observe(t *testing.T) {
 				mg: helmRelease(),
 			},
 			want: want{
-				out: managed.ExternalObservation{ResourceExists: true, ResourceUpToDate: true},
+				out: managed.ExternalObservation{ResourceExists: true, ResourceUpToDate: true, ConnectionDetails: managed.ConnectionDetails{}},
 				err: nil,
 			},
 		},