Secret Management in Kubernetes: The GitOps Way - Benjamin Ritter
summary
Compares concrete GitOps secret patterns: kubeseal sealed-secrets (CLI + controller, cluster-rooted asymmetric encryption, per-cluster seals, 30‑day key rotation), External Secrets operator (polling sync from AWS/HashiCorp, credential bootstrapping required, API rate/delay limits), Secrets Store CSI and Vault sidecar (mounts or injects live secrets, near‑instant updates), and service operators/Crossplane (cluster provisions resources and writes generated passwords, removing manual creds). Recommends kubeseal for small/static setups, external secrets for shared stores, and service accounts/operators for managed infrastructure.
AI-written summary · about
chapters (9)
- 0:00Introduction and challenges
- 2:04Secret management strategies
- 4:26Bitnami Sealed Secrets
- 7:13External Secrets operator
- 9:43Vault and CSI drivers
- 11:18Automated provisioning
- 14:48Certificates and rotation
- 17:21Best practices and selection
- 20:33Q&A session
related talks
01h 02mSecret Management: The Soft Way
29mSecuring secrets in the GitOps era
43mSecuring Secrets in the GitOps Era
24mUnlocking the Secrets to Effective Secrets Management in GitOps
29m100,000 Different Ways to Manage Secrets in GitOps
46mSecuring Secrets in the GitOps era
24mCan You Keep a Secret? On Secret Management in Kubernetes
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!