Securing Secrets in the GitOps Era
Talkat JCON Europe 2023 · on Tuesday, 2023-06-20· at 14:00· Cinema 5, Im Mediapark 1, 50670 Köln, Germany·
summary
Kubernetes Secrets are just base64-encoded by default, so the talk shows concrete fixes: use Sealed Secrets (kubeseal encrypts YAML with a cluster public key) or ExternalSecrets to sync from a manager; Argo CD deploys encrypted objects from Git; use an external KMS or move etcd off-cluster because node-local keys still expose data; prefer memory-only fetches or dynamic credentials from HashiCorp Vault; aim for frequent rotation (examples use 10–15 minute refresh) and add mesh/monitoring (Istio, Falco) for defense in depth.
AI-written summary · about
chapters (18)
- 0:00Introduction to securing secrets
- 1:24Why secrets need multiple layers
- 2:52DevOps and GitOps explained
- 5:44GitOps delivery model with Argo CD
- 8:16Demo of GitOps deployment
- 9:43Kubernetes secrets are not secure
- 11:09Techniques to protect secrets
- 11:31Sealed Secrets project demo
- 15:02External Secrets project demo
- 28:59Securing secrets in Argo CD
- 31:59Best ways to inject secrets
- 34:06Secret management in applications
- 36:38No single solution for secrets
- 37:25Common attack vectors on secrets
- 38:09Secret and key rotation strategies
- 38:51Using Istio and security tools
- 39:32Dynamic Secrets with HashiCorp Vault
- 40:54Resources and closing remarks
related talks
46mSecuring Secrets in the GitOps era
24mUnlocking the Secrets to Effective Secrets Management in GitOps
29mSecuring secrets in the GitOps era
29m100,000 Different Ways to Manage Secrets in GitOps
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
43mA Confidential Story of Well-Kept Secrets
17mHandling secrets in kubernetes using git secrets
54mKeeping Kubernetes Secrets