WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Apr 18, 2023

Securing Secrets in the GitOps era

Alex Soto

Standard Kubernetes secrets are merely Base64-encoded, leaving your repositories exposed. Ready to build an onion-layered defense and completely eliminate hardcoded credentials from your cloud-native architecture?

Pause
Mute Enter Fullscreen
#1 about 7 min

Introduction to securing secrets in GitOps deployments

Secrets require multiple layers of protection to remain concealed within deployment environments.

#2 about 5 min

Understanding continuous delivery in the GitOps model

Git serves as the single source of truth for both application and infrastructure code.

#3 about 3 min

Application delivery workflow with continuous integration repositories

Application code changes trigger an automated pipeline that updates infrastructure configurations.

#4 about 3 min

Automating cluster synchronization with Argo CD controllers

Argo CD monitors configuration repositories and applies infrastructure changes to Kubernetes clusters.

#5 about 3 min

Vulnerabilities of storing unencrypted secrets in repositories

Base64 encoding fails to securely protect sensitive information inside Kubernetes secret files.

#6 about 3 min

Encrypting secret manifests using the Sealed Secrets project

Sealed Secrets introduces public and private key pairs to encrypt sensitive data before repository storage.

#7 about 4 min

Generating and applying sealed secret manifests via Kubeseal

Kubeseal encrypts standard secrets into safely distributable forms that controllers decrypt inside the cluster.

#8 about 5 min

Vulnerabilities of plaintext secrets within the etcd database

Cluster administrators or attackers can retrieve unencrypted secrets by accessing etcd logs or backups.

#9 about 2 min

Protecting etcd databases using Key Management System plugins

Key Management Systems delegate encryption tasks to external providers like HashiCorp Vault to secure data at rest.

#10 about 6 min

Demonstrating database encryption at rest with HashiCorp Vault

Integrating a Vault instance guarantees that etcd database queries cannot extract unencrypted operational data.

#11 about 3 min

Injecting secrets directly into pod memory structures

Avoiding environment variables and disk files blocks localized attackers from recovering application credentials.

#12 about 3 min

Generating dynamic application secrets using HashiCorp Vault engines

Dynamic secrets automatically generate temporary access credentials without requiring localized storage or human interaction.

#13 about 5 min

Retrieving dynamic database credentials during pod runtime

Deploying a frontend application that securely fetches generated credentials directly from a dynamic storage engine.

#14 about 3 min

Additional resources on GitOps and Kubernetes secret management

Authors and open-source materials offer deeper architectural insights and practical configuration recipes.

#15 about 3 min

Transitioning toward developer responsibility in security models

Modern enterprises increasingly require developers to understand and enforce infrastructure security constraints.

#16 about 2 min

Evaluating decentralized versus centralized secret management strategies

Organizational maturity requirements dictate whether secrets should be centrally controlled or managed by individual capability teams.

#17 about 2 min

Synchronizing localized environments using service virtualization

Containerized profiles and mocked services isolate application access without loading complex developer environments.

#18 about 2 min

Converting dynamic repository secrets into localized environment files

Agent utilities parse external secret providers into local environment variables for application consumption.

#19 about 2 min

Defining developer experience functions within modern engineering teams

Managing the usability of internal tooling improves adoption speeds and minimizes configuration friction for coding teams.

Matching moments

3:42 min

Managing secrets and security in a GitOps model

Roberth Strand · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

4:08 min

Security risks of storing native Kubernetes secrets in git

Davide Imola Davide Imola · LIVE

2:30 min

Handling passwords and certificates securely via Kubernetes secrets

Aurélie Vache Aurélie Vache · World Congress 2026 Europe

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

5:03 min

Designing a self-service internal developer platform with GitOps

Patrick Koss Patrick Koss · World Congress 2026 Europe

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Tech Education in Two Languages thumbnail
1:00:18
6 days ago

WeAreDevelopers LIVE - Tech Education in Two Languages

Daniel Cranney, Roxy Rodriguez-Becker

WeAreDevelopers LIVE - Playing in Production thumbnail
1:06:40
13 days ago

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
27 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
about 1 month ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
about 1 month ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
about 1 month ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

We Deleted Our Observability Stack and Rebuilt It with OTEL: 12 Engineers to 4 at 20K+ clusters

  • Yash Sharma

    DigitalOcean

    Developer Advocate

Open session

How We Cut Our API's p99 Latency from Minutes to Under a Second

  • Deepak Agrawal

    Atlassian

    Principal Software Engineer

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

Beyond File Dumps: Context Engineering for Coding Agents

  • Animesh Dutta

    Arm

    Senior Software Engineer

Related videos

Securing secrets in the GitOps Era thumbnail
58:52
LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Best Practices for Using GitHub Secrets thumbnail
36:33
LIVE • about 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail
56:06
LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
World Congress 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Kubernetes Security Best Practices thumbnail
23:08
World Congress 2025 • about 1 year ago

Kubernetes Security Best Practices

Rico Komenda

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.