Secrets in GitOps: Sealed Secrets, SOPS, and External Secrets

1. 1

   Install both controllers through Argo CD

   Platform components are Applications too, living in the same repo. Here's ESO; sealed-secrets is identical with chart sealed-secrets from https://bitnami-labs.github.io/sealed-secrets into kube-system. They go in a platform project in real setups.

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
     name: external-secrets
     namespace: argocd
     annotations:
       argocd.argoproj.io/sync-wave: "-10"   # before apps that need secrets
   spec:
     project: default
     source:
       repoURL: https://charts.external-secrets.io
       chart: external-secrets
       targetRevision: 0.20.1
       helm:
         valuesObject:
           installCRDs: true
     destination:
       server: https://kubernetes.default.svc
       namespace: external-secrets
     syncPolicy:
       automated: { prune: true, selfHeal: true }
       syncOptions: [CreateNamespace=true, ServerSideApply=true]

2. 2

   Seal the dev Redis password

   Create the Secret locally with --dry-run (it never reaches the cluster or disk as plain text), pipe it through kubeseal, and commit the output. The ciphertext is bound to this name and namespace, so copying it elsewhere won't decrypt.

   terminalcopy cmd

   $ kubectl create secret generic redis-auth -n shoplite-dev \

   --from-literal=redis-password="$(openssl rand -hex 16)" --dry-run=client -o yaml \

   | kubeseal --format yaml > apps/web/overlays/dev/redis-auth.sealed.yaml

   grep -A2 encryptedData apps/web/overlays/dev/redis-auth.sealed.yaml

   ── expected output ──

   encryptedData:

   redis-password: AgBy3i4OJSWK+PiTySYZZA1rO43cGDEq...

3. 3

   Connect ESO to AWS Secrets Manager

   A ClusterSecretStore says where secrets live and how to authenticate. On EKS the operator's service account is bound to an IAM role via IRSA or Pod Identity (AWS course, EKS topic), allowed secretsmanager:GetSecretValue only on shoplite/*. No access keys anywhere.

   apiVersion: external-secrets.io/v1
   kind: ClusterSecretStore
   metadata:
     name: aws-secrets-manager
   spec:
     provider:
       aws:
         service: SecretsManager
         region: ap-south-1
         auth:
           jwt:
             serviceAccountRef:
               name: external-secrets
               namespace: external-secrets

4. 4

   Reference the prod DB secret

   This file is safe to commit: it contains names, not values. ESO creates a normal Secret web-db that the Deployment mounts as usual. refreshInterval picks up rotations; pods need a restart (or Reloader) to see new env values.

   apiVersion: external-secrets.io/v1
   kind: ExternalSecret
   metadata:
     name: web-db
   spec:
     refreshInterval: 1h
     secretStoreRef:
       kind: ClusterSecretStore
       name: aws-secrets-manager
     target:
       name: web-db
       creationPolicy: Owner
     data:
       - secretKey: DB_PASSWORD
         remoteRef:
           key: shoplite/prod/db
           property: password
       - secretKey: DB_USER
         remoteRef:
           key: shoplite/prod/db
           property: username

5. 5

   Verify

   Add the new file to the prod overlay's resources, push, and check the ExternalSecret's status. SecretSynced means the Secret exists in the cluster.

   terminalcopy cmd

   $ git add . && git commit -m 'secrets: sealed (dev) + ESO (prod)' && git push

   kubectl -n shoplite-prod get externalsecret web-db

   kubectl -n shoplite-dev get secret redis-auth

   ── expected output ──

   NAME STORE REFRESH INTERVAL STATUS READY

   web-db aws-secrets-manager 1h SecretSynced True

   NAME TYPE DATA AGE

   redis-auth Opaque 1 2m

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.