You cannot commit plaintext secrets to git. How do you handle secrets in GitOps?

Question

Accepted Answer

This is the genuinely awkward part of GitOps, because the model wants everything in git but you obviously cannot put plaintext secrets in a repo, and a Kubernetes Secret is only base64-encoded, which is not encryption. There are three common approaches. SOPS: I encrypt the secret values in git using SOPS backed by a KMS or age key, so what is committed is ciphertext, and the controller, or a SOPS integration, decrypts it in-cluster at apply time. Sealed Secrets: I encrypt a secret to a cluster-specific public key, producing a SealedSecret custom resource that only that cluster controller can decrypt with its private key, so the sealed form is safe to commit. External Secrets Operator: I do not put the secret in git at all, only a reference, the real secret lives in a manager like Vault or a cloud secrets service, and the operator fetches it and materializes a Kubernetes Secret at runtime. The trade-offs: SOPS and Sealed Secrets keep an encrypted copy in git, simple and self-contained but you manage encryption keys and rotation in-band; the External Secrets approach keeps git free of secret material and centralizes rotation and audit in a real manager, at the cost of running that integration. I lean toward External Secrets when there is already a secrets manager, and SOPS or Sealed Secrets for simpler setups.

Answer

What is the trade-off between Sealed Secrets/SOPS and the External Secrets Operator?

SOPS/Sealed Secrets keep an encrypted copy in git, self-contained but you handle keys/rotation. External Secrets keeps no secret in git (just a reference) and centralizes rotation/audit in a real manager, at the cost of running that integration.

Answer

Why is a plain Kubernetes Secret not enough here?

It is only base64-encoded, not encrypted, so committing it puts the secret effectively in plaintext in git history. You need encryption (SOPS/Sealed Secrets) or a reference to an external manager.

You cannot commit plaintext secrets to git. How do you handle secrets in GitOps?

You cannot commit plaintext secrets to git. How do you handle secrets in GitOps?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with gitops

Knowing the answer is not the same as recalling it under pressure