100,000 Different Ways to Manage Secrets in GitOps
Talkat GitOpsCon Europe 2022 · on Tuesday, 2022-05-17· at 09:45· Pavilion 3 | Room E | Level 2 | Central Forum·
summary
Concrete workflows and tradeoffs for keeping secrets out of Git: use Sealed Secrets to encrypt values (easy to start but one cluster key breaks multi‑tenant scaling), use external backends with a controller or the Vault agent injector sidecar to auto‑refresh rotated secrets, or mount secrets via the CSI driver to avoid Kubernetes Secrets altogether. Integrations shown include Flux/ArgoCD plugins, sops for repo encryption, and detection with Yelp detect‑secrets plus GitHub/AWS scanning, so practical options exist to stop committing plaintext.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:00GitOps Principles
- 2:08Where sensitive assets come from
- 3:08Managing GitOps the wrong way
- 4:27Implications of improper secrets management
- 6:08How to store secrets
- 6:44Which tool is the right one
- 7:46GitOps traits
- 8:44Where to store secrets
- 9:26How to reference secrets
- 10:43Tools
- 13:19Kubernetes
- 15:20Sealed Secrets
- 17:46GitOps Engine
- 21:17How to Use Secrets
- 21:29How to Consume Secrets
- 21:54Limitations to Secrets
- 22:23Sidecar
- 24:20Kubernetes CSI Driver
- 25:38Implementing CSI Driver in Kubernetes
- 26:38Preventative Measures
- 28:08Security is Continuous
- 28:45Thank you
related talks
43mSecuring Secrets in the GitOps Era
29mSecuring secrets in the GitOps era
46mSecuring Secrets in the GitOps era
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
10mLightning Talk: How to Keep a Secret in GitOps, Without Keeping...
24mUnlocking the Secrets to Effective Secrets Management in GitOps
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!
35mShh, It’s a Secret: Managing Your Secrets in a GitOps Way