Kubernetes Secrets are base64 encoded, not encrypted. For production you need a better solution.

Problems with K8s Secrets¶

• Base64 != encryption
• Visible in etcd (unless encryption at rest)
• Accessible via API to anyone with RBAC permissions

External Secrets Operator¶

apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: app-secrets spec: refreshInterval: 1h secretStoreRef: name: vault kind: ClusterSecretStore data: - secretKey: DB_PASSWORD remoteRef: key: secret/myapp property: db_password

Sealed Secrets¶

Encrypt secret¶

kubeseal –format yaml < secret.yaml > sealed-secret.yaml

sealed-secret.yaml is safe for Git!¶

Key Takeaway¶

Never plain K8s Secrets in Git. External Secrets Operator + Vault for production, Sealed Secrets for GitOps.