GitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!
summary
GitOps keeps cluster state in Git but the concrete rule here is don't store raw kubernetes secrets in git and don't bake secrets into container images. The recommended pattern is to use an external secret store (Vault or cloud providers) with kubernetes external secrets: a controller pulls provider secrets, materializes Kubernetes Secrets at runtime, and lets you keep references in Git. Jenkins X supplies a small helper, jx secret CLI, to manage those ExternalSecret CRs within the Git-centric workflow.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:49What is GitOps
- 5:18What are Kubernetes secrets
- 8:25Don't store secrets in Git
- 9:26Secret management strategies
- 11:29Baking secrets into images
- 14:40Using external secret managers
- 17:25Kubernetes external secrets
- 18:29Jenkins X secret management
- 19:31Wrap-up and key rule
related talks
46mSecuring Secrets in the GitOps era
29m100,000 Different Ways to Manage Secrets in GitOps
43mSecuring Secrets in the GitOps Era
29mSecuring secrets in the GitOps era
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
24mUnlocking the Secrets to Effective Secrets Management in GitOps
17mHandling secrets in kubernetes using git secrets
25mGitOps and Secrets: State of the Union