Understanding Secrets Managers

We’ve covered what makes Secrets special and how to approach secret data, now we need to talk about how to manage them. There are four ways most clusters manage Secrets:

• Kubernetes Secrets: Storing all secrets as Secret objects without any kind of external management.
• Sealed Secrets: Secret data is encrypted in files stored in Git.
• External Secrets Manager: An external service, such as HashiCorp’s Vault or a cloud-based secrets manager, is used to store secrets for your cluster.
• Hybrid: By syncing secret data from an external secrets manager into generic Kubernetes Secret objects you get an approach that allows for the Secrets API while still maintaining your source of truth about secret data outside of your cluster.

Let’s walk through each approach to managing secrets.

Storing Secrets as Secret Objects

The first option seems like the easiest. Leveraging Kubernetes Secret objects provides...