|CI/CD & GitOps
Secret Management in GitOps: Sealed Secrets vs. External Secrets Operator
Architecting secure, automated secret synchronization from AWS Secrets Manager and HashiCorp Vault without committing plain text.
The core philosophy of GitOps states that Git is the single source of truth. However, committing base64-encoded Kubernetes secrets directly to version control violates fundamental security principles.
External Secrets Operator (ESO)
The modern industry standard is the External Secrets Operator. ESO runs in-cluster and integrates with cloud secret managers (AWS Secrets Manager, HashiCorp Vault, Google Secret Manager).
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: database-credentials
spec:
refreshInterval: "1h"
secretStoreRef:
name: aws-secrets-manager
kind: ClusterSecretStore
target:
name: db-secret
data:
- secretKey: password
remoteRef:
key: production/database
property: password
- Benefits: Centralized rotation, granular IAM access control via IRSA (IAM Roles for Service Accounts), and zero plaintext secrets in Git.