GitOps and Secrets: State of the Union
summary
Argo CD recommends externalizing secret management and points to the external-secret-operator or the secret store CSI driver as the supported paths. A demo wires HashiCorp Vault to the external secret operator, deploys only secret references, and rotates a compromised credential with zero restarts and no Argo CD syncs. The external secret operator provides a CRD of secret references that materialize Kubernetes secrets, and applications should load secrets from files + auto-reload to avoid forced pod restarts.
AI-written summary · about
chapters (7)
- 0:00GitOps and secrets intro
- 2:29Secrets in Argo CD
- 5:16Secret rotation with ESO
- 10:26Argo CD and secrets
- 14:42App secret best practices
- 18:14Helm secret cycle
- 20:20Q&A
related talks
35mShh, It’s a Secret: Managing Your Secrets in a GitOps Way
14mExploring HashiCorp Vault and ArgoCD the GitOps Way
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...
48mEffortless Secrets Management in Kubernetes
43mSecuring Secrets in the GitOps Era
29m100,000 Different Ways to Manage Secrets in GitOps
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!