WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Apr 18, 2023

Securing Secrets in the GitOps era

Alex Soto

Standard Kubernetes secrets are merely Base64-encoded, leaving your repositories exposed. Ready to build an onion-layered defense and completely eliminate hardcoded credentials from your cloud-native architecture?

Pause
Mute Enter Fullscreen
#1 about 7 min

Introduction to securing secrets in GitOps deployments

Secrets require multiple layers of protection to remain concealed within deployment environments.

#2 about 5 min

Understanding continuous delivery in the GitOps model

Git serves as the single source of truth for both application and infrastructure code.

#3 about 3 min

Application delivery workflow with continuous integration repositories

Application code changes trigger an automated pipeline that updates infrastructure configurations.

#4 about 3 min

Automating cluster synchronization with Argo CD controllers

Argo CD monitors configuration repositories and applies infrastructure changes to Kubernetes clusters.

#5 about 3 min

Vulnerabilities of storing unencrypted secrets in repositories

Base64 encoding fails to securely protect sensitive information inside Kubernetes secret files.

#6 about 3 min

Encrypting secret manifests using the Sealed Secrets project

Sealed Secrets introduces public and private key pairs to encrypt sensitive data before repository storage.

#7 about 4 min

Generating and applying sealed secret manifests via Kubeseal

Kubeseal encrypts standard secrets into safely distributable forms that controllers decrypt inside the cluster.

#8 about 5 min

Vulnerabilities of plaintext secrets within the etcd database

Cluster administrators or attackers can retrieve unencrypted secrets by accessing etcd logs or backups.

#9 about 2 min

Protecting etcd databases using Key Management System plugins

Key Management Systems delegate encryption tasks to external providers like HashiCorp Vault to secure data at rest.

#10 about 6 min

Demonstrating database encryption at rest with HashiCorp Vault

Integrating a Vault instance guarantees that etcd database queries cannot extract unencrypted operational data.

#11 about 3 min

Injecting secrets directly into pod memory structures

Avoiding environment variables and disk files blocks localized attackers from recovering application credentials.

#12 about 3 min

Generating dynamic application secrets using HashiCorp Vault engines

Dynamic secrets automatically generate temporary access credentials without requiring localized storage or human interaction.

#13 about 5 min

Retrieving dynamic database credentials during pod runtime

Deploying a frontend application that securely fetches generated credentials directly from a dynamic storage engine.

#14 about 3 min

Additional resources on GitOps and Kubernetes secret management

Authors and open-source materials offer deeper architectural insights and practical configuration recipes.

#15 about 3 min

Transitioning toward developer responsibility in security models

Modern enterprises increasingly require developers to understand and enforce infrastructure security constraints.

#16 about 2 min

Evaluating decentralized versus centralized secret management strategies

Organizational maturity requirements dictate whether secrets should be centrally controlled or managed by individual capability teams.

#17 about 2 min

Synchronizing localized environments using service virtualization

Containerized profiles and mocked services isolate application access without loading complex developer environments.

#18 about 2 min

Converting dynamic repository secrets into localized environment files

Agent utilities parse external secret providers into local environment variables for application consumption.

#19 about 2 min

Defining developer experience functions within modern engineering teams

Managing the usability of internal tooling improves adoption speeds and minimizes configuration friction for coding teams.

Matching moments

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

4:08 min

Security risks of storing native Kubernetes secrets in git

Davide Imola Davide Imola · LIVE

2:30 min

Handling passwords and certificates securely via Kubernetes secrets

Aurélie Vache Aurélie Vache · WWC Europe 2026

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

5:03 min

Designing a self-service internal developer platform with GitOps

Patrick Koss Patrick Koss · WWC Europe 2026

3:42 min

Best practices for ignoring and securely vaulting secrets

Dwayne Mcdaniel · LIVE

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

From Static Rules to Reasoning Platforms: Scaling Intelligent Canary Delivery in 2026

Daniel Oh

Senior Principal Developer Advocate

Daniel Oh

Related videos

Securing secrets in the GitOps Era thumbnail
58:52
LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Best Practices for Using GitHub Secrets thumbnail
36:33
LIVE • almost 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail
56:06
LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
WWC 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Kubernetes Security Best Practices thumbnail
23:08
WWC 2025 • 12 months ago

Kubernetes Security Best Practices

Rico Komenda

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.