Bitnami Sealed Secrets - How To Store Kubernetes Secrets In Git Repositories
Source: YouTube · DevOps & AI Toolkit · published Jan 6, 2021 · 17:01
Storing secrets in Git is insecure with standard encoding, but using Bitnami Sealed Secrets allows storing the entire desired state—including secrets—securely in Git, making it the single source of truth for infrastructure. 2:00-2:14
Key Takeaways:
• Setting up this workflow requires a Kubernetes cluster, the kubeseal CLI, and installing the Sealed Secrets controller inside the cluster to handle decryption. 2:56-3:08
• Standard Kubernetes secrets in Git are unsafe because they are merely Base64 encoded, which is easily decrypted by anyone with access to the repository. 6:39-7:08
• The kubeseal CLI encrypts secrets into a "SealedSecret" format before committing to Git, ensuring the raw secret remains unreadable to public repositories. 8:29-8:54
• When a SealedSecret is applied to the cluster, the installed controller automatically decrypts it into a standard Secret resource that pods can consume. 10:19-11:02
• This approach ensures security because only the controller within the specific Kubernetes cluster can decrypt the secrets, preventing unauthorized access from Git users. 14:49-15:03
This approach enables Flux or Argo CD to manage the full desired state from Git, securing the pipeline without relying on external secrets managers. 16:24-16:36
Sources:
- 2:00-2:14 - Proposal to store everything in Git.
- 2:56-3:08 - Required setup components.
- 6:39-7:08 - Base64 encoding insecurity.
- [8:29-8:54](https://www.youtube.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
those are secrets i can store everything you get except secrets pure you would get fired probably that would be well awful everything we do is in git what are you doing victor are you using it i mean of course you are using it uh if you're not then you're in a wrong channel you you're probably interested in fashion advice or i don't know some hobby site but you are here because you're a software engineer and you are using it and hopefully you're moving your way of operating stuff to be based on githubs you're probably using one of the github's tools like argo cd or flux to manage the synchronization between what is defined in it and what is the actual state in your clusters if you're confused and you don't know what github sees then the link is above go check it out and it explains what gi…