Committing everything to Git? What about Secrets?

In a GitOps workflow, the idea of committing every piece of configuration to Git repositories is central. It ensures that the entire state of your infrastructure is declaratively represented and can be versioned, audited, and reviewed. However, this approach presents a challenge when it comes to handling secrets, such as passwords, tokens, and private keys. Storing such sensitive information plainly in Git repositories is not secure. This is where tools such as Sealed Secrets and External Secrets come into play, providing secure mechanisms to manage secrets in a GitOps workflow.

Sealed Secrets

Sealed Secrets [2] is a Kubernetes controller and toolset, designed to encrypt secrets that can safely be stored in Git repositories. When you apply the sealed secret to your cluster, the Sealed Secrets controller decrypts it and creates a regular Kubernetes secret. This process allows you to manage your secrets’ life cycle through...