Optimizing Secrets Management
summary
Deploys a small stack on EKS: External Secrets Operator + reloader with backend AWS Secrets Manager, using IRSA (an IAM role) with four narrow permissions to Describe/List/Get secrets. Creates a ClusterSecretStore and a ClusterExternalSecret that syncs into a normal Kubernetes Secret every minute, auto-recreates deleted secrets, and triggers rolling restarts so pods pick up updates; demo shows env var updated live and the workflow working end-to-end.
AI-written summary · about
chapters (11)
- 0:00Start
- 5:09Disaster Recovery Strategies for Secrets
- 7:32Set Up Reloader
- 7:55Install Reloader
- 11:54Deploy External Secrets
- 13:37Install the External Secrets Operator
- 16:23Secret Manager
- 22:11External Secrets
- 27:19Deploy a Test Application
- 36:36Automatic Secrets Rotation
- 37:21Secret Synchronization
related talks
24mCan You Keep a Secret? On Secret Management in Kubernetes
30mLook Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
05mexternal-secrets: Zero Trust Secrets Management with ESO
43mA Confidential Story of Well-Kept Secrets
26mThe Power of SecretOps Automating Secret Workflows
35mAutomate Secret Rotation in Kubernetes, Then Get Out of the Way!
37mExternal Secrets Operator