How do you manage secrets in a GitOps workflow — Sealed Secrets, SOPS, External Secrets Operator?

Plain Kubernetes Secrets encoded as base64 cannot be committed to a Git repository — the value is trivially decodable by anyone with repo access. Three patterns solve this, with different trust models and operational tradeoffs.

1. Sealed Secrets (Bitnami): The sealed-secrets-controller running in the cluster holds a private key. You use the kubeseal CLI to encrypt a regular Secret into a SealedSecret CR — encrypted with the cluster's public key. Only that cluster's controller can decrypt it. The SealedSecret YAML is safe to commit to Git. On sync, the controller decrypts it back into a regular Kubernetes Secret.

# SealedSecret — safe to commit to Git
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  encryptedData:
    password: AgBy8I5V2EqtcPmVTiIuEolW...(encrypted blob)

2. SOPS (Mozilla): Encrypts entire secret files (YAML, JSON, .env) using AWS KMS, GCP KMS, HashiCorp Vault, or age keys. The encrypted file is committed to Git. Flux natively supports SOPS decryption — configure a spec.decryption block in the Kustomization CR pointing to a Kubernetes Secret that holds the decryption key. Argo CD requires a custom config management plugin for SOPS.

3. External Secrets Operator (ESO): An ExternalSecret CR in Git declares which key to fetch from an external store (AWS SSM Parameter Store, HashiCorp Vault, GCP Secret Manager, Azure Key Vault). The ESO controller fetches the secret value and creates a regular Kubernetes Secret. The actual secret value never lives in Git at all — only the reference does.

# ExternalSecret — references AWS SSM, no secret value in Git
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-ssm-store
    kind: ClusterSecretStore
  target:
    name: db-credentials
  data:
    - secretKey: password
      remoteRef:
        key: /prod/db/password