All 28 GitOps Principles questions
More in GitOps Principles
What is configuration drift and how does GitOps handle it? What are the benefits of GitOps over traditional deployment approaches? How do you perform a rollback in a GitOps workflow? What belongs in Git and what should not in a GitOps setup? How does GitOps improve security and compliance? How does GitOps enable auditability and compliance evidence? What is the difference between GitOps and Infrastructure as Code (IaC)? How do you handle non-Kubernetes resources in a GitOps model? How does GitOps improve developer experience? What role do webhooks play in GitOps with ArgoCD?
Advertisement
ArgoCD › GitOps Principles

How are secrets managed securely in a GitOps workflow?

Intermediate

Answer

Because plaintext secrets can't live in Git, common patterns are: Bitnami Sealed Secrets (encrypt secrets that only the in-cluster controller can decrypt), the External Secrets Operator (sync from Vault/AWS/GCP secret managers), or SOPS with age/KMS to store encrypted secrets in Git. ArgoCD applies the encrypted/referencing resource and the operator resolves the real value.
# SealedSecret committed to Git; controller decrypts in-cluster
kind: SealedSecret
spec:
  encryptedData:
    password: AgB2b3c...
Real-world example The team commits SealedSecrets to Git; only the cluster's controller can decrypt them, keeping the repo safe to share.

Common follow-ups: How do Sealed Secrets differ from External Secrets? | What is SOPS?

RBAC Applications GitOps Principles
All 28 GitOps Principles questions