What you will learn
- Use sealed secrets
- Integrate external secret stores
- Avoid plaintext in repos
New to this? Start here
The basics, in plain English
GitOps stores everything in Git, but you cannot put raw passwords there because anyone could read them. Managing secrets in GitOps means storing them in a safe, encrypted way so the files in Git stay harmless while the real secret is still delivered securely to the cluster.
- Secret
- Sensitive data like a password or key that must stay private.
- Encrypted secret
- A secret scrambled so it is safe to store in Git, unreadable without the key.
- Sealed secret
- A common method where only the cluster can unscramble the stored secret.
- External vault
- Keeping the real secret in a separate secure store, not in Git at all.
- Decryption
- Unscrambling the secret inside the cluster when it is actually needed.
- Why not plain
- Plain-text secrets in Git could be seen by anyone with repo access.
01
Encrypted at rest
Sealed Secrets encrypt values so only the cluster can decrypt them. External Secrets Operator pulls from Vault or cloud managers at runtime.
Finished this topic?
Mark it done to earn 100 XP and keep your streak alive.