Kubernetes Secrets Management: SOPS, Sealed Secrets, or External Secrets

Thu, 19 Dec 2024 10:00:00 +0000

Kubernetes Secrets are not secret. That’s the first thing nobody tells you. A Secret object is base64-encoded YAML sitting in etcd, and base64 is encoding, not encryption — anyone with get secrets on the namespace can read it back in plaintext with a single command. Encryption at rest in etcd helps a little, but the real problem turns up the moment you adopt GitOps: now you want everything in a repo, and committing a base64 blob of your database password to Git is the kind of decision that ends careers. So you reach for tooling. There are three serious contenders, and I’ve run all of them in anger.

Secrets - Tag - vo.rs

Kubernetes Secrets Management: SOPS, Sealed Secrets, or External Secrets