Securing secrets in the GitOps era
summary
Explains concrete ways to store secrets for GitOps on Kubernetes, showing how Sealed Secrets plus a Helm operator and the kubeseal CLI encrypt secrets with the cluster public key and how a seal/commit/reconcile workflow produces a regular k8s Secret to keep an app running. Compares that approach to hosted or self-hosted secret stores such as HashiCorp Vault, and outlines tradeoffs including costs, rotation complexity, required operational steps (seal, regenerate, push) and single‑point‑of‑failure risks.
AI-written summary · about
chapters (9)
- 0:00GitOps and secrets
- 2:10GitOps benefits
- 5:19Secrets in Git problem
- 7:31Sealed Secrets solution
- 9:39Sealed Secrets demo
- 15:32Sealed Secrets pros/cons
- 17:22Secret Manager alternatives
- 20:53Secret Manager costs
- 23:00Q&A
related talks
43mSecuring Secrets in the GitOps Era
46mSecuring Secrets in the GitOps era
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
24mUnlocking the Secrets to Effective Secrets Management in GitOps
29m100,000 Different Ways to Manage Secrets in GitOps
17mHandling secrets in kubernetes using git secrets
01h 02mSecret Management: The Soft Way
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!