Look Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap

This talk explores the challenges of managing Kubernetes Secrets, which can present significant maintenance and security issues. The speaker discusses four traditional secret management approaches, including storing secrets in Git, using encryption tools like git-crypt or Mozilla SOPS, deploying Sealed Secrets, and leveraging External Secrets operators, each with their own trade-offs in access control and encryption. The focus then shifts to Secret-Store-CSI, a Container Storage Interface that integrates with cloud-based secret management solutions such as AWS Secrets Manager or HashiCorp Vault. Through a live demonstration, the speaker illustrates the deployment of Secret-Store-CSI in an AWS Kubernetes cluster, showcasing how it mounts secrets directly as a storage volume in the pod without creating Kubernetes secret resources, and how it updates automatically when secrets change in the external manager.