Look Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap
summary
Compares four secret workflows (plain Git, git-crypt, Sealed Secrets, External Secrets) and demos a CSI-based alternative: Secret-Store-CSI mounts cloud secrets as volumes so no k8s Secret objects are created. Deploys CSI driver + AWS provider on a cluster, uses a SecretProviderClass CRD and IRSA-like service account to let the operator read AWS Secrets Manager, app reads mounted files, and stakater-reloader triggers reloads; refresh interval is ~15s. Works in demo for AWS/Azure but still allows pod-level read access and breaks unmodified Helm charts.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:28Secret Management
- 8:04Seal Secrets
- 11:56External Secrets Operator
- 16:20Secret CSI Driver
- 25:35Conclusion
related talks
24mCan You Keep a Secret? On Secret Management in Kubernetes
36mSecrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8s
24mSecrets Store CSI Driver: Keeping Secrets Secret
01h 02mSecret Management: The Soft Way
30mHow to Make Kubernetes Secrets Really… Secret?
29mSecuring secrets in the GitOps era
46mSecuring Secrets in the GitOps era
29m100,000 Different Ways to Manage Secrets in GitOps