GitOps and Kubernetes – Secure Handling of Secrets

• sealed-secrets

  28 5,984 8.6 Go

  A Kubernetes controller and tool for one-way encrypted Secrets

  

  An option that easily works with GitOps is the Operator Sealed Secrets from Bitnami. Secrets encrypted with it can only be decrypted by operators running inside the cluster, not even by the original author. For encryption, there is a CLI (and a third-party web UI) that requires a connection to the cluster. The disadvantage of this is that the key material is stored in the cluster, the secrets are bound to the cluster and one has to take care of backups and operation.

• sealed-secrets-web

  1 33 10.0 Go

  A web interface for Sealed Secrets by Bitnami.

  An option that easily works with GitOps is the Operator Sealed Secrets from Bitnami. Secrets encrypted with it can only be decrypted by operators running inside the cluster, not even by the original author. For encryption, there is a CLI (and a third-party web UI) that requires a connection to the cluster. The disadvantage of this is that the key material is stored in the cluster, the secrets are bound to the cluster and one has to take care of backups and operation.

• SonarLint

  www.sonarlint.org

  sponsored

  Clean code begins in your IDE with SonarLint. Up your coding game and discover issues early. SonarLint is a free plugin that helps you find & fix bugs and security issues from the moment you start writing code. Install from your favorite IDE marketplace today.

  

• external-secrets

  13 2,439 9.7 Go

  External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

  

  External Secrets is an operator that integrates external KMS such as Hashicorp Vault or those of the major cloud providers. It reads secrets from the external APIs and injects them into Kubernetes secrets. The operator is a new implementation after the merge of similar projects from GoDaddy and ContainerSolutions.

• vault-k8s

  3 686 7.2 Go

  First-class support for Vault and Kubernetes.

  

  Hashicorp Vault k8s is an operator that modifies pods via a mutating webhook to connect between vault and pod via sidecars (additional containers) to provide secrets. This has the major advantage that no secret objects are created in Kubernetes here. The disadvantage is that this way only works with Vault.

• argocd-vault-plugin

  6 596 5.8 Go

  An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets

  

  ArgoCD supports SOPS with the vault Plugin.

• helm-secrets

  6 912 8.4 Shell

  A helm plugin that help manage secrets with Git workflow and store them anywhere

  There is also the helm secrets plugin, which can also be used in ArgoCD with manual configuration.

• sops-secrets-operator

  2 212 4.9 Go

  Kubernetes SOPS secrets operator

  There is also a third-party sops-secrets operator available.

• InfluxDB

  www.influxdata.com

  sponsored

  Access the most powerful time series database as a service. Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression.

  

Suggest a related project