As others have mentioned, this doesn’t scratch the surface on the actual hard stuff. How do you get your secrets deployed to k8s, and kept up to date? Some opt

As others have mentioned, this doesn’t scratch the surface on the actual hard stuff. How do you get your secrets deployed to k8s, and kept up to date? Some options I like: * vault. Very flexible, you can have your app talk directly to vault and skip writing your secrets to disk. Or use plugins to populate k8s secrets from vault for consumers that can’t talk directly to vault. It’s a bit of a pain to operate vault and best practice is to put it in its own VM/cluster as k8s is not sufficiently isolated between processes. * sealed-secrets / kops. You can encrypt your secrets with public/private keys and commit the encrypted blob along side your code. The private key lives in your cluster or deploy env. Has the strong advantage that secret-changes can be validated and deployed like any other code change, instead of requiring an OOB deploy process. * your cloud provider’s KMS. Does what vault would do here, no operational maintenance is a plus. But you don’t get many of the fancy features from vault if you take this path. (GCP’s Secret Manager gives you a nice UI for managing secret versions though, for example). I’m sure there are many other approaches too, these are just ones I’ve used at different times.