Shh, It’s a Secret: Managing Your Secrets in a GitOps Way
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 15:25· 411 Theater + Online·
summary
A GitOps-friendly secret flow that actually replaces placeholders in committed YAML during Argo CD’s repo-server step and requires no cluster operator: the team builds argocd-vault-plugin, installs it as a repo-server init task, and uses kubernetes auth to fetch secrets from HashiCorp Vault (plus AWS Secrets Manager and community GCP/Azure backends). Demo shows nginx reading a Vault-stored password and a successful secret rotation via Argo CD hard refresh; Helm support (Redis) is implemented using inline path placeholders though the live demo hits a repo-credentials glitch.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:49Journey into Kubernetes
- 6:03Why Argo CD
- 9:46The Idea
- 14:54Demo
- 15:24Getting Started
- 16:14Installing the Plugin
- 17:44Registering the Plugin
- 20:17Basic Git App
- 23:03Creating an Argo App
- 25:00Rotating Secrets
- 26:45Deploying Secrets
- 28:04Deploying Secrets with Helm
- 30:18Questions
related talks
14mExploring HashiCorp Vault and ArgoCD the GitOps Way
10mLightning Talk: Exploring HashiCorp Vault and ArgoCD - the GitOps Way
25mGitOps and Secrets: State of the Union
48mEffortless Secrets Management in Kubernetes
29m100,000 Different Ways to Manage Secrets in GitOps
43mSecuring Secrets in the GitOps Era
46mSecuring Secrets in the GitOps era
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...