Il GitOps sta diventando sempre più popolare soprattutto quando si comincia a parlare di Kubernetes. Ovviamente con l'avvento di nuove tecnologie e best practice, nascono anche nuovi dubbi, tipo: Come posso gestire i miei secret avendo a che fare con il GitOps?

1. Davide Imola
How do you not share your secrets in a git repo?

2. • Software Engineer @ RedCarbon
• Community Manager @ Schrodinger Hat
davideimola.dev
@davideImola
$ whoami

4. Is a way of managing the infrastructure and
applications so that the whole system is
described declaratively and version-
controlled, and having an automated
process of deployment.

5. • managing the infrastructure and app lifecycle
within a single tool
• faster deployments
• helps the DevOps adoption of an
organization

7. Git Repository
MySuperFantasticApp.yaml
kind: Deployment
…
…
…
…
1234567890
DBSecret.yaml
kind: Secret
…
SUPER_SECURE_DB_PWD:
MTIzNDU2Nzg5MAo=
…

9. Git Repository
MySuperFantasticApp.yaml
kind: Deployment
…
…
…
…
1234567890
DBSecret.yaml
kind: Secret
…
SUPER_SECURE_DB_PWD:
MTIzNDU2Nzg5MAo=

10. TIMES THE PASSWORD IS HACKED

11. A Sad Developer

14. • Only the Kubernetes cluster is able to decrypt the secret
• Uses a public/private key to encrypt/decrypt secrets
• They can be accessed and used from other K8s objects like normal secrets
• The public key can be stored inside the repository

15. Hail to the Demo God

16. • Easy to use and to configure
• Works like a normal K8s secret
• The secrets are stored inside of Git
• Not so fast to change the value of a
secret
• Not so easy to retrieve the history of a
secret

18. • They can be self-hosted and “OSS" like HashiCorp Vault or Cloud managed
like Vault Cloud, AWS Secrets Manager, etc…
• Managing a secret is simplified thanks to the Web UI
• In the case of managed no infrastructure is required

19. • Web application where to handle your
secrets and change them whenever
you want
• Database of secrets
• Possibility to scale up easily
• Operate rotations
• Costs
• Management

20. davideimola.dev