A Confidential Story of Well-Kept Secrets
summary
Kubernetes secrets land unencrypted in etcd by default so a migration from another orchestrator drives concrete choices: use an external secrets manager plus external-secrets-operator to fetch values, deploy via Argo CD GitOps, authenticate with IAM Roles for Service Accounts instead of static keys, and add KMS envelope encryption for etcd plus encrypted volumes. OPA Gatekeeper constraints block secrets-as-env and roles that grant secret verbs; the pipeline creates cluster secrets at runtime and the policies successfully prevent unsafe deployments.
AI-written summary · about
chapters (4)
related talks
43mSecuring Secrets in the GitOps Era
46mSecuring Secrets in the GitOps era
24mUnlocking the Secrets to Effective Secrets Management in GitOps
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
29mHow to Make Kubernetes Secrets Really… Secret?
01h 02mSecret Management: The Soft Way
29m100,000 Different Ways to Manage Secrets in GitOps
54mKeeping Kubernetes secrets secret