Securing Secrets in the GitOps era
summary
Kubernetes stores secrets base64-encoded in etcd so they’re readable if you get the data store; two pragmatic GitOps fixes: Sealed Secrets encrypts YAML locally with a cluster public key and a controller decrypts on apply, while External Secrets polls Vault/AWS/GCP and materializes k8s Secrets at runtime. For runtime safety use a KMS plugin or Vault dynamic DB credentials (rotate every 15–30 minutes). Demo shows tooling works but deployment and key placement matter.
AI-written summary · about
chapters (15)
- 0:00Introduction to talk
- 1:15What is a secret
- 4:04Security is about layers
- 4:46DevOps and GitOps explained
- 8:39Problem with Kubernetes secrets
- 10:05Seal Secrets for Git encryption
- 12:34External Secrets with Vault
- 14:43Demo of Seal Secrets
- 19:09Demo of External Secrets
- 21:57Encrypting secrets in etcd
- 25:55Injecting secrets into pods
- 28:02Using Vault for secrets
- 31:16Dynamic secrets with Vault
- 33:45Summary and key takeaways
- 38:02Q&A session
related talks
43mSecuring Secrets in the GitOps Era
24mUnlocking the Secrets to Effective Secrets Management in GitOps
29mSecuring secrets in the GitOps era
29m100,000 Different Ways to Manage Secrets in GitOps
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
54mKeeping Kubernetes Secrets
54mKeeping Kubernetes secrets secret
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!