How do you manage secrets in a GitOps workflow — Sealed Secrets, SOPS, External Secrets Operator?

Plain Kubernetes Secrets encoded as base64 cannot be committed to a Git repository — the value is trivially decodable by anyone with repo access. Three patterns solve this, with different trust models and operational tradeoffs.

1. Sealed Secrets (Bitnami): The sealed-secrets-controller running in the cluster holds a private key. You use the kubeseal CLI to encrypt a regular Secret into a SealedSecret CR — encrypted with the cluster's public key. Only that cluster's controller can decrypt it. The SealedSecret YAML is safe to commit to Git. On sync, the controller decrypts it back into a regular Kubernetes Secret.

# SealedSecret — safe to commit to Git
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  encryptedData:
    password: AgBy8I5V2EqtcPmVTiIuEolW...(encrypted blob)

2. SOPS (Mozilla): Encrypts entire secret files (YAML, JSON, .env) using AWS KMS, GCP KMS, HashiCorp Vault, or age keys. The encrypted file is committed to Git. Flux natively supports SOPS decryption — configure a spec.decryption block in the Kustomization CR pointing to a Kubernetes Secret that holds the decryption key. Argo CD requires a custom config management plugin for SOPS.

3. External Secrets Operator (ESO): An ExternalSecret CR in Git declares which key to fetch from an external store (AWS SSM Parameter Store, HashiCorp Vault, GCP Secret Manager, Azure Key Vault). The ESO controller fetches the secret value and creates a regular Kubernetes Secret. The actual secret value never lives in Git at all — only the reference does.

# ExternalSecret — references AWS SSM, no secret value in Git
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-ssm-store
    kind: ClusterSecretStore
  target:
    name: db-credentials
  data:
    - secretKey: password
      remoteRef:
        key: /prod/db/password

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.