WeAreDevelopers LIVE • Feb 12, 2024

Securing secrets in the GitOps Era

Storing plain-text Kubernetes secrets in Git exposes your entire infrastructure. How can you protect sensitive credentials without breaking automated deployment pipelines driven by Flux or ArgoCD?

Pause

Mute

Enter Fullscreen

#1 about 6 min

Understanding principles and benefits of the GitOps workflow

How declarative version control establishes a unified deployment path for clusters.

#2 about 5 min

Security risks of storing native Kubernetes secrets in git

Why relying on standard base64 encoding exposes sensitive passwords within version control.

#3 about 4 min

Encrypting configurations with the Sealed Secrets cluster operator

Utilizing asymmetric keys to securely store and decrypt configuration data inside clusters.

#4 about 13 min

Demonstration of kubeseal encryption and Flux deployment reconciliation

A practical walkthrough encrypting manual credentials and verifying automated cluster deployment reconciliation.

#5 about 4 min

Evaluating the operational trade-offs of Sealed Secrets

The simplicity of native configurations compared to the manual overhead of updating payloads.

#6 about 5 min

Advanced credential rotation utilizing dedicated Secrets Managers

Deploying centralized database platforms enables granular management interfaces and automated credential scaling.

#7 about 5 min

Integrating cluster resources directly with Secrets Managers

Connecting cluster workloads securely utilizing dedicated provider libraries and container storage interfaces.

#8 about 19 min

Audience Q&A on tenant isolation and continuous integration

Strategies for isolating access layers, restricting public interfaces, and adapting permissions dynamically.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto

Alex Soto · LIVE

2:03 min

Additional resources on GitOps and Kubernetes secret management

Alex Soto

Alex Soto · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

2:30 min

Handling passwords and certificates securely via Kubernetes secrets

Aurélie Vache

Aurélie Vache · World Congress 2026 Europe

4:29 min

Configuring a DevSecOps pipeline and Oversecured integration demo

Moataz Nabil

Moataz Nabil · LIVE

5:03 min

Designing a self-service internal developer platform with GitOps

Patrick Koss

Patrick Koss · World Congress 2026 Europe

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

about 1 month ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Related videos

Securing Secrets in the GitOps era thumbnail

LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Best Practices for Using GitHub Secrets thumbnail

LIVE • about 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail

World Congress 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail

LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

How to GitOps your cluster with Flux thumbnail

LIVE • over 3 years ago

How to GitOps your cluster with Flux

Davide Imola

Practical tips and tricks for CI/CD success thumbnail

LIVE • over 4 years ago

Practical tips and tricks for CI/CD success

Zan Markan

Related articles

DC

Daniel Cranney

The Overflow: 5 Security and Privacy Tools for Developers

We’re back again with another edition of the Overflow, where we share some of the best tools we’ve found from around the web that we just couldn’t cram into the already jam-packed editions of the D...

6 months ago

A laptop with a padlock chained around it

CH

Chris Heilmann

Stop Googling Git Commands. Start Actually Learning Git.

Every developer has been there. You’re mid-flow, about to push a feature branch, and you need to undo your last three commits without blowing up the remote history. So you do what you always do: yo...

5 months ago

The Git Skills homepage showing you quizzes and how-tos.

DC

Daniel Cranney

Dev Digest 214: Claude Is Leaking, GitHub Is Listening & Axios Hacked!

Inside last week’s Dev Digest 214 . 🕵️ Claude source code leaked, analysed and re-written in 2 days 🐙 GitHub auto-opts users into feeding their code to train their AI 🌐 Pretext shows how to show c...

6 months ago

DC

Daniel Cranney

Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.

Everyone thinks CISOs make the final call on security tools. But in modern software organisations, adoption starts long before the boardroom, inside CI/CD pipelines, developer workflows, and pull r...

7 months ago

A room full of people at a tech conference

From learning to earning

Jobs that call for the skills explored in this talk.

Cloud Engineer (German)

Barcelona, Spain

26 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

26 days ago • Verified

Senior Software Engineer, Secure Build

Expert Remote Go

26 days ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes

DevSecOps Engineer

Meckenheim, Germany

Expert €71k–104k Devsecops Kubernetes Data Centers

26 days ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership