Secret Management: The Soft Way
summary
Shows two concrete pipelines for getting secrets into Kubernetes and proves both work live. Option A encrypts YAML with sealed-secrets + kubeseal: cluster operator creates a public/private key pair, developers encrypt with the public key, the controller decrypts to a Kubernetes Secret; keys are cluster-local so you must reseal per cluster and avoid sharing the private key. Option B uses Vault + External Secrets Operator: operator authenticates with a service account mapped to a Vault role, reads entries, and materializes k8s Secrets; more setup but supports rotation and many providers.
AI-written summary · about
chapters (12)
- 0:00Introduction to secret management
- 1:30Speaker background
- 3:17Kubernetes secrets not secret
- 5:48GitOps limits for secrets
- 9:21Dev access and DevOps challenges
- 10:44Security desire paths
- 13:52Developer priorities
- 18:35Soft secret approaches
- 23:35Demo: Encrypt secrets with Sealed Secrets
- 37:45Demo: External Secrets Operator with HashiCorp Vault
- 45:41Summary
- 49:10Q&A
related talks
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
24mUnlocking the Secrets to Effective Secrets Management in GitOps
54mKeeping Kubernetes secrets secret
29mSecuring secrets in the GitOps era
54mKeeping Kubernetes Secrets
46mSecuring Secrets in the GitOps era
41mEasy Secrets in Kubernetes: Because I Vault It Well
43mSecuring Secrets in the GitOps Era