At a previous job, I set up all our Kubernetes secrets such that their canonical location was in pass; Creating or updating them was a simple shell script:

At a previous job, I set up all our Kubernetes secrets such that their canonical location was in pass; Creating or updating them was a simple shell script: kubectl create secret generic -o yaml --dry-run \ --from-literal "foo=$(pass show foo)" foo | kubectl apply -f - I was very pleased with it - It was simple enough for developers to use where necessary, easy to distribute passwords, and worked very well. The next guy ripped it out and replaced with Vault and none of the passwords have been rotated since.