> Markdown version of [/videos/852-securing-secrets-in-the-gitops-era?t=459](https://www.wearedevelopers.com/videos/852-securing-secrets-in-the-gitops-era?t=459). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Securing secrets in the GitOps Era

Storing plain-text Kubernetes secrets in Git exposes your entire infrastructure. How can you protect sensitive credentials without breaking automated deployment pipelines driven by Flux or ArgoCD?

- **Speakers:** [Davide Imola](https://www.wearedevelopers.com/@davide-imola)
- **Event:** WeAreDevelopers LIVE
- **Published:** February 12, 2024
- **Duration:** 58:52
- **URL:** https://www.wearedevelopers.com/videos/852-securing-secrets-in-the-gitops-era

## Summary

In the GitOps era, where the Git repository acts as the single source of truth for infrastructure and application lifecycles, handling sensitive data poses a critical challenge. Storing plain-text or base64-encoded Kubernetes secrets directly in version control exposes infrastructure to severe security vulnerabilities. Developers need a systematic approach to ensure that passwords, API keys, and other credentials remain secure without breaking the declarative, automated deployment pipelines driven by tools like Flux and ArgoCD.

To resolve this problem, DevOps teams can leverage two primary methodologies. The first approach utilizes Bitnami Sealed Secrets, a Kubernetes operator that enables secure secret storage within Git. Using a public key, developers encrypt secrets before committing them, and the cluster decrypts them natively using a corresponding private key. While lightweight and fully aligned with the GitOps philosophy, this method can complicate secret rotation and historical version tracking. Alternatively, organizations can integrate dedicated Secret Managers, such as HashiCorp Vault, OpenBao, or cloud-managed solutions like AWS Secrets Manager. These platforms provide centralized management, automated credential rotation, and robust scaling, connecting to Kubernetes environments via application SDKs or CSI drivers.

Ultimately, securing secrets in GitOps requires balancing architectural simplicity with rigorous security boundaries. While Sealed Secrets tightly couple configuration to version control, Secret Managers excel at granular access control and dynamic lifecycle management. By implementing role-based authentication policies, utilizing Kubernetes service accounts, and intentionally restricting third-party application access, engineering teams can mitigate secret sprawl and maintain a resilient, fully automated deployment workflow.

**Keywords:** gitops secrets management, kubernetes sealed secrets, flux cd deployments, argocd infrastructure management, bitnami sealed secrets operator, base64 encoded secrets challenge, public key encryption, hashicorp vault integration, openbao secret manager, aws secrets manager, kubernetes csi drivers, automated credential rotation, kubernetes service accounts, declarative cluster configuration, secret sprawl mitigation

## Chapters

1. **Understanding principles and benefits of the GitOps workflow** (01:45) — How declarative version control establishes a unified deployment path for clusters.
1. **Security risks of storing native Kubernetes secrets in git** (07:39) — Why relying on standard base64 encoding exposes sensitive passwords within version control.
1. **Encrypting configurations with the Sealed Secrets cluster operator** (11:47) — Utilizing asymmetric keys to securely store and decrypt configuration data inside clusters.
1. **Demonstration of kubeseal encryption and Flux deployment reconciliation** (15:08) — A practical walkthrough encrypting manual credentials and verifying automated cluster deployment reconciliation.
1. **Evaluating the operational trade-offs of Sealed Secrets** (27:56) — The simplicity of native configurations compared to the manual overhead of updating payloads.
1. **Advanced credential rotation utilizing dedicated Secrets Managers** (31:00) — Deploying centralized database platforms enables granular management interfaces and automated credential scaling.
1. **Integrating cluster resources directly with Secrets Managers** (35:55) — Connecting cluster workloads securely utilizing dedicated provider libraries and container storage interfaces.
1. **Audience Q&A on tenant isolation and continuous integration** (40:34) — Strategies for isolating access layers, restricting public interfaces, and adapting permissions dynamically.

## Related Moments

- [Introduction to securing secrets in GitOps deployments](https://www.wearedevelopers.com/videos/546-securing-secrets-in-the-gitops-era) (from "Securing Secrets in the GitOps era")
- [Additional resources on GitOps and Kubernetes secret management](https://www.wearedevelopers.com/videos/546-securing-secrets-in-the-gitops-era) (from "Securing Secrets in the GitOps era")
- [Injecting sensitive configuration values via Kubernetes secrets](https://www.wearedevelopers.com/videos/530-mastering-kubernetes-beginner-edition) (from "Mastering Kubernetes – Beginner Edition")
- [Handling passwords and certificates securely via Kubernetes secrets](https://www.wearedevelopers.com/videos/100085-understanding-kubernetes-in-a-visual-way) (from "Understanding Kubernetes in a visual way")
- [Configuring a DevSecOps pipeline and Oversecured integration demo](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) (from "DevSecOps: Injecting Security into Mobile CI/CD Pipelines")
- [Designing a self-service internal developer platform with GitOps](https://www.wearedevelopers.com/videos/100137-building-a-cloud-platform-where-everything-is-just-another-kubernetes-resource) (from "Building a Cloud Platform Where Everything is Just Another Kubernetes Resource")

## Related Articles

- [The Overflow: 5 Security and Privacy Tools for Developers](https://www.wearedevelopers.com/magazine/710-the-overflow-5-security-and-privacy-tools-for-developers)
- [Stop Googling Git Commands. Start Actually Learning Git.](https://www.wearedevelopers.com/magazine/730-stop-googling-git-commands-start-actually-learning-git)
- [Dev Digest 214: Claude Is Leaking, GitHub Is Listening & Axios Hacked!](https://www.wearedevelopers.com/magazine/719-dev-digest-214-claude-is-leaking-github-is-listening-axios-hacked)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)

## Related Jobs

- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Cloud Foundations Team](https://www.wearedevelopers.com/jobs/ext/1483289-cloud-foundations-team) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Devops Engineer](https://www.wearedevelopers.com/jobs/ext/1940926-devops-engineer) at **Bitpanda**
- [SecOps Engineer - Full Managed Cloud Stack](https://www.wearedevelopers.com/jobs/ext/99610-secops-engineer-full-managed-cloud-stack) at **BWI GmbH**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**