In standard Kubernetes, a Secret object is not encrypted — it is merely encoded in Base64 (echo "password" | base64). Anyone who reads your Git repository or has access to kubectl can instantly decode it:
bash
$ echo "U3VwZXJTZWNyZXRQYXNzd29yZDEyMw==" | base64 -d
SuperSecretPassword123
Never commit standard Kubernetes Secrets or .env files to Git. In this lesson, you will master production secret management using Bitnami Sealed Secrets and HashiCorp Vault.
Approach 1: Bitnami Sealed Secrets (Ideal for GitOps)
Sealed Secrets uses Asymmetric Cryptography (Public/Private Key Encryption):
- Public Key (Local Developer): Can only encrypt secrets into a
SealedSecretmanifest that is 100% safe to commit to public Git. - Private Key (Cluster Only): Lives exclusively inside the Kubernetes cluster controller and decrypts the sealed secret into a native Kubernetes Secret in memory.
100%
Rendering interactive visual diagram...
Hands-On: Creating a SealedSecret
bash
# 1. Create a temporary local secret (Do NOT commit this to Git)
kubectl create secret generic db-credentials --from-literal=password='SuperSecureDBPassword2026!' --dry-run=client -o yaml > secret.yaml
# 2. Seal the secret using the cluster's public encryption key
kubeseal --format=yaml < secret.yaml > sealed-secret.yaml
# 3. Delete the plain-text secret file!
rm secret.yaml
Now, inspect sealed-secret.yaml:
yaml
apiVersion: bitnamia.com/v1alpha1
kind: SealedSecret
metadata:
name: db-credentials
namespace: production
spec:
encryptedData:
password: AgBy19aX0zLk...[COMPLETELY ENCRYPTED CIPHERTEXT]...8qPw==
This file is 100% safe to commit to your public Git repository.
Approach 2: HashiCorp Vault (Enterprise Dynamic Secrets)
HashiCorp Vault is the industry standard for centralized secret management, offering Dynamic Secrets (generating unique database credentials on the fly that expire automatically in 1 hour).
100%
Rendering interactive visual diagram...
Benefits of Vault Dynamic Secrets:
- No Static Passwords: Passwords do not exist until an application requests one.
- Automated Revocation: When the pod dies, Vault automatically drops the user from the database.
- Audit Trail: Every secret access is logged with the requesting pod's identity.