🔒𝗦𝘁𝗼𝗿𝗶𝗻𝗴 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗦𝗲𝗰𝗿𝗲𝘁𝘀 𝗦𝗲𝗰𝘂𝗿𝗲𝗹𝘆 𝘄𝗶𝘁𝗵 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗦𝗲𝗰𝗿𝗲𝘁𝘀 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿

🔒𝗦𝘁𝗼𝗿𝗶𝗻𝗴 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗦𝗲𝗰𝗿𝗲𝘁𝘀 𝗦𝗲𝗰𝘂𝗿𝗲𝗹𝘆 𝘄𝗶𝘁𝗵 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗦𝗲𝗰𝗿𝗲𝘁𝘀 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿

With the growing adoption of the GitOps principle where a single source of truth is maintained for everything, all application manifests (deployments, configmaps, ingresses, etc.) are stored in a version control system.

However, 𝘀𝗲𝗻𝘀𝗶𝘁𝗶𝘃𝗲 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 such as credentials stored in Kubernetes Secrets cannot be committed to version control in plain text and even Base64 encoding isn’t safe, since it can be decoded easily (it’s encoding, not encryption).

Here are a few ways to store Kubernetes secrets in a Git repository without compromising them:

1️⃣Using External Secrets Operator backed by a secret manager backend like AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, etc.
2️⃣Using a Sealed Secrets controller running in your Kubernetes cluster.
3️⃣ Using SOPS, which encrypts secrets using AWS KMS, GCP KMS, and other key management services.

In this post, I’ll focus on 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗦𝗲𝗰𝗿𝗲𝘁𝘀 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 (𝗘𝗦𝗢)

🔑 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗦𝗲𝗰𝗿𝗲𝘁 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿
Instead of storing your Kubernetes Secrets directly in Git, you store them in a secure backend (AWS Secrets Manager, Parameter Store, HashiCorp Vault, Azure Key Vault, etc.) and let the External Secrets Operator sync them into your cluster.

𝗛𝗼𝘄 𝗶𝘁 𝘄𝗼𝗿𝗸𝘀
1️⃣ Store your secret in AWS Secrets Manager, Parameter Store, Vault, or another supported backend.
2️⃣ Create a 𝗦𝗲𝗰𝗿𝗲𝘁𝗦𝘁𝗼𝗿𝗲 or 𝗖𝗹𝘂𝘀𝘁𝗲𝗿𝗦𝗲𝗰𝗿𝗲𝘁𝗦𝘁𝗼𝗿𝗲 this Custom Resource Definition (CRD) specifies:

• The backend type (AWS, Vault, Azure, etc.)
• The authentication method used to access the backend. 3️⃣ Create an 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹𝗦𝗲𝗰𝗿𝗲𝘁, this CRD is stored in Git and references:
• The 𝗦𝗲𝗰𝗿𝗲𝘁𝗦𝘁𝗼𝗿𝗲
• The name of the secret in the backend
• The name of the Kubernetes Secret to be created 4️⃣ The External Secrets Operator reads the 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹𝗦𝗲𝗰𝗿𝗲𝘁, authenticates to the backend using the credentials defined in the 𝗦𝗲𝗰𝗿𝗲𝘁𝗦𝘁𝗼𝗿𝗲, fetches the secret, and creates the Kubernetes Secret in your cluster. 5️⃣ 𝗘𝗦𝗢 𝗰𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀𝗹𝘆 𝘀𝘆𝗻𝗰𝘀 secrets from the backend to Kubernetes, ensuring they are always up to date according to the sync configuration.

How are you managing Kubernetes secrets in your GitOps workflow?