Unlocking the Secrets to Effective Secrets Management in GitOps
summary
Kubernetes secrets are base64 by default so kubernetes secrets are base64 encoded not encrypted, which makes them easy to decode. The talk compares three real options: Sealed Secrets (CLI encrypts a secret with a cluster public key and the operator uses the private key to unseal, sealed-secrets encrypts with cluster private key; good for storing encrypted YAML in Git but not ideal at large scale), Secret Store CSI (mounts external stores as files), and External Secrets Operator (external-secrets operator is production-ready) which syncs external providers into k8s secrets.
AI-written summary · about
chapters (11)
- 0:00GitOps and secrets management
- 3:28GitOps with Kubernetes
- 4:32What are secrets
- 7:01Problems with secrets in GitOps
- 9:05Kubernetes secrets insecurity
- 11:33Secret management solutions
- 11:54Sealed Secrets deep dive
- 14:03Secret Store CSI driver
- 17:13External Secrets operator
- 20:02Live demo: Sealed Secrets
- 23:09Summary
related talks
43mSecuring Secrets in the GitOps Era
46mSecuring Secrets in the GitOps era
29mSecuring secrets in the GitOps era
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
29m100,000 Different Ways to Manage Secrets in GitOps
54mKeeping Kubernetes secrets secret
01h 02mSecret Management: The Soft Way
54mKeeping Kubernetes Secrets