Handle secrets in GitOps

$ run as a normal user# run as root (or with sudo)

Know the options

Choose by where the secret's source of truth lives.

Option	In Git	Decrypted by
Sealed Secrets	An encrypted `SealedSecret`	A controller in the cluster (its private key)
SOPS (+ age or cloud KMS)	Encrypted values in normal YAML	Flux (built in) or Argo CD plugin
External Secrets Operator	Only a reference (`ExternalSecret`)	The operator fetches from Vault / Key Vault

6.2

Use Sealed Secrets

kubeseal encrypts with the cluster's public key; only the controller can decrypt.

$helm install sealed-secrets sealed-secrets/sealed-secrets -n kube-system
$kubectl create secret generic db -n shop --from-literal=password='S3cret!' --dry-run=client -o yaml > db-secret.yaml
$kubeseal --format yaml < db-secret.yaml > db-sealed.yaml
$rm db-secret.yaml
$git add db-sealed.yaml && git commit -m "Add sealed DB secret"

Watch out

Back up the controller's key pair. Without it, a rebuilt cluster can not decrypt any sealed secret.

6.3

Use SOPS with age

SOPS encrypts only the values of a YAML file; keys stay readable for review.

$age-keygen -o age.agekey
$cat > .sops.yaml << 'EOF'
creation_rules:
  - path_regex: .*.secret.yaml
    encrypted_regex: ^(data|stringData)$
    age: age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq
EOF
$sops --encrypt --in-place db.secret.yaml
$sops db.secret.yaml
$kubectl create secret generic sops-age -n flux-system --from-file=age.agekey

In the Flux Kustomization add decryption: { provider: sops, secretRef: { name: sops-age } }.

6.4

Use External Secrets Operator

The secret stays in Azure Key Vault (or Vault); Git only says which secret to fetch.

external-secret.yaml

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata: { name: db, namespace: shop }
spec:
  refreshInterval: 1h
  secretStoreRef: { name: azure-kv, kind: ClusterSecretStore }
  target: { name: db }
  data:
    - secretKey: password
      remoteRef: { key: shop-db-password }

Remember

With ESO, rotation happens in the store; the cluster picks up the new value at the next refresh — no Git commit needed.

All commands in this chapter