Lightning Talk: How to Keep a Secret in GitOps, Without Keeping...
summary
Compares six concrete solutions—Sealed Secrets, Argo CD Vault Plugin, SOPS, Vault Agent, Secrets Store CSI Driver, and External Secrets Operator—and claims External Secrets Operator plus passwordless authentication wins for production. Lists practical tradeoffs: Sealed Secrets risks global key compromise; Argo CD plugin only works at render time and trusts all developers; SOPS repeats key-management bottlenecks; Vault Agent creates per‑pod connections and scalability limits; CSI mounts files but ties to storage. External Secrets provides per‑app roles, multiple backends, easy install and scalable updates.
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:26Sealed Secrets
- 2:45Argo CD Vault Plugin
- 4:23SOPS (Secrets Operations)
- 5:50Vault Agent Injector
- 7:05Secrets Store CSI
- 8:15External Secrets Operator
related talks
29m100,000 Different Ways to Manage Secrets in GitOps
43mSecuring Secrets in the GitOps Era
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
29mSecuring secrets in the GitOps era
25mGitOps and Secrets: State of the Union
46mSecuring Secrets in the GitOps era
34mWhich Vault? Don't tell me your secret(s)!
24mUnlocking the Secrets to Effective Secrets Management in GitOps