WeAreDevelopers LIVE • Feb 12, 2024

Securing secrets in the GitOps Era

Storing plain-text Kubernetes secrets in Git exposes your entire infrastructure. How can you protect sensitive credentials without breaking automated deployment pipelines driven by Flux or ArgoCD?

Pause

Mute

Enter Fullscreen

#1 about 6 min

Understanding principles and benefits of the GitOps workflow

How declarative version control establishes a unified deployment path for clusters.

#2 about 5 min

Security risks of storing native Kubernetes secrets in git

Why relying on standard base64 encoding exposes sensitive passwords within version control.

#3 about 4 min

Encrypting configurations with the Sealed Secrets cluster operator

Utilizing asymmetric keys to securely store and decrypt configuration data inside clusters.

#4 about 13 min

Demonstration of kubeseal encryption and Flux deployment reconciliation

A practical walkthrough encrypting manual credentials and verifying automated cluster deployment reconciliation.

#5 about 4 min

Evaluating the operational trade-offs of Sealed Secrets

The simplicity of native configurations compared to the manual overhead of updating payloads.

#6 about 5 min

Advanced credential rotation utilizing dedicated Secrets Managers

Deploying centralized database platforms enables granular management interfaces and automated credential scaling.

#7 about 5 min

Integrating cluster resources directly with Secrets Managers

Connecting cluster workloads securely utilizing dedicated provider libraries and container storage interfaces.

#8 about 19 min

Audience Q&A on tenant isolation and continuous integration

Strategies for isolating access layers, restricting public interfaces, and adapting permissions dynamically.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto

Alex Soto · LIVE

2:03 min

Additional resources on GitOps and Kubernetes secret management

Alex Soto

Alex Soto · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

2:30 min

Handling passwords and certificates securely via Kubernetes secrets

Aurélie Vache

Aurélie Vache · World Congress 2026 Europe

4:29 min

Configuring a DevSecOps pipeline and Oversecured integration demo

Moataz Nabil

Moataz Nabil · LIVE

5:03 min

Designing a self-service internal developer platform with GitOps

Patrick Koss

Patrick Koss · World Congress 2026 Europe

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail

about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Tech Leaders Stage

Ship with Context: GitLab Orbit and Google Cloud for AI-Powered Software Delivery

Michael Angelo Rivera, Mike Duchesne

Michael Angelo Rivera

Mike Duchesne

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 2

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

World Congress 2026 North America

September 25, 2026 · 15:30–16:00

Mainstage

One Boundary for the Agentic Era

Mark Lechner

Chief Information Security Officer, Dokcer

Mark Lechner

Related videos

Securing Secrets in the GitOps era thumbnail

LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Best Practices for Using GitHub Secrets thumbnail

LIVE • almost 2 years ago

Best Practices for Using GitHub Secrets

Marcel Lupo

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail

World Congress 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail

LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

How to GitOps your cluster with Flux thumbnail

LIVE • over 3 years ago

How to GitOps your cluster with Flux

Davide Imola

Practical tips and tricks for CI/CD success thumbnail

LIVE • over 4 years ago

Practical tips and tricks for CI/CD success

Zan Markan

Related articles

DC

Daniel Cranney

The Overflow: 5 Security and Privacy Tools for Developers

We’re back again with another edition of the Overflow, where we share some of the best tools we’ve found from around the web that we just couldn’t cram into the already jam-packed editions of the D...

5 months ago

A laptop with a padlock chained around it

CH

Chris Heilmann

Stop Googling Git Commands. Start Actually Learning Git.

Every developer has been there. You’re mid-flow, about to push a feature branch, and you need to undo your last three commits without blowing up the remote history. So you do what you always do: yo...

4 months ago

The Git Skills homepage showing you quizzes and how-tos.

DC

Daniel Cranney

Dev Digest 214: Claude Is Leaking, GitHub Is Listening & Axios Hacked!

Inside last week’s Dev Digest 214 . 🕵️ Claude source code leaked, analysed and re-written in 2 days 🐙 GitHub auto-opts users into feeding their code to train their AI 🌐 Pretext shows how to show c...

5 months ago

DC

Daniel Cranney

Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.

Everyone thinks CISOs make the final call on security tools. But in modern software organisations, adoption starts long before the boardroom, inside CI/CD pipelines, developer workflows, and pull r...

7 months ago

A room full of people at a tech conference

From learning to earning

Jobs that call for the skills explored in this talk.

5 days ago • Verified

Senior Supply Chain Security Engineer

Expert Remote Linux Kubernetes

5 days ago • Verified

Senior Software Engineer, Secure Build

Expert Remote Go

5 days ago • Verified

Principal Software Engineer, Docker Hardened Images

Expert Remote Kubernetes

5 days ago • Verified

Manager, Engineering, Secure Build and SCS Services

Expert Remote Team Leadership

Cloud SecOps Engineer - Storage

Bamberg, Germany

Expert €57k–84k Git Linux Golang

Software Engineer, Infrastructure Platform

Cartagena, Spain

€72k–123k Remote Linux Istio Docker