Secrets Management in GitOps

Secrets in GitOps: SOPS+age, Sealed Secrets, External Secrets Operator (ESO). Vault integration patterns. When to use each approach.

Overview

Overview

GitOps stores all configuration in Git as the single source of truth, but secrets (API keys, passwords, TLS certificates) must never be committed in plaintext. The tension: how do you manage secrets declaratively alongside other config without exposing sensitive values?

Three patterns

  • Encrypt in Git — SOPS, Sealed Secrets — Encrypted values
  • Reference externally — External Secrets Operator, Vault agent — A reference to a path in an external store; no sensitive values
  • Hybrid — ESO syncing from Vault into Kubernetes Secrets — An ExternalSecret pointing at Vault

> [!NOTE] Each pattern has distinct operational trade-offs; none is free.

Encrypt in Git

  • SOPS + age — Encrypts values inside YAML/JSON/ENV so structure stays readable; ArgoCD or Flux decrypts with the age private key held in a cluster Secret — Simple, works with any backend — Key rotation complexity; the decryption key must exist in-cluster
  • Sealed Secrets — kubeseal encrypts to a SealedSecret CRD only the in-cluster controller can decrypt — Dead simple, GitOps-native — Cluster-bound; key rotation requires re-sealing all secrets

Reference externally

  • Centralized secret management; rotation handled by the external store; no secrets in Git — Dependency on the external store; ESO must be highly available

Vault integration patterns

  • Vault Agent Injector — Sidecar reads Vault secrets and writes them to a shared volume as files
  • Vault Secrets Operator (VSO) — Vault's own CRD-based operator, similar to ESO but Vault-native
  • ESO with the Vault provider — Unified ESO approach alongside other stores

> [!TIP] Vault adds complexity but provides dynamic short-lived credentials (database, AWS IAM roles), a PKI CA, audit logging and multi-datacenter replication.

Sign up free to read the full topic

More DevOps topics

Start free on Cariara · Coding problems · System design studio