Learning with K3s at home. Is it "better" to store secrets encrypted in the git repo (e.g., sealed-secrets) or in a separately managed secret database (e.g., vault)?

• sealed-secrets

  71 7,120 9.2 Go

  A Kubernetes controller and tool for one-way encrypted Secrets

  

store secrets encrypted in the public git repo (e.g., sealed-secrets)

• Vault

  160 29,644 10.0 Go

  A tool for secrets management, encryption as a service, and privileged access management

  

store secrets encrypted in a separately managed secret database (e.g., vault)

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• argocd-vault-plugin

  9 760 7.3 Go

  An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets

  

argoproj-labs/argocd-vault-plugin

• sops

  150 15,114 9.0 Go

  Simple and flexible tool for managing secrets

  

sops

• git-crypt

  50 7,968 0.0 C++

  Transparent file encryption in git

git-crypt

• gitops-environment-promotion

  2 241 0.0

  Example for promoting a release between different GitOps environments

Yes. I personally use Kustomize overlays. Here is an contrived example with 10+ envs https://github.com/kostis-codefresh/gitops-environment-promotion/tree/main/envs

• vault-secrets-operator

  5 610 8.0 Go

  Create Kubernetes secrets from Vault for a secure GitOps based workflow.

For home use, I wouldn't bother with Vault unless that's really what you want to learn. Then it's worth looking into setting something up where you could use vault secrets, using one of the available options (I haven't seen the vault-secrets-operator being mentioned).

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• rpi

  1 1 10.0 Makefile

  k3s@home setup (by slowr)

I use sops with age for my local k3s at home. Take a look here: https://github.com/slowr/rpi

Suggest a related project