Do you know ways to deliver secrets without Vault Agent Injector? How to store encrypted secrets in Git?

There are several ways to deliver secrets and store encrypted secrets in Git without using Vault Agent Injector:

1. Encrypting secrets before committing to Git

   • Using tools like git-crypt or BlackBox, which allow encrypting specific files in the repository.
   • Encryption keys are stored separately and provided only to trusted users.

2. Using KMS (Key Management Service)

   • Store secrets in encrypted form using cloud KMS (AWS KMS, GCP KMS, Azure Key Vault).
   • Secrets are decrypted during the CI/CD process using KMS.

3. Encryption with SOPS (Secrets OPerationS)

   • A tool from Mozilla that allows encrypting YAML/JSON/ENV files using KMS or PGP.
   • Files are stored in the repository in encrypted form and decrypted during deployment.

4. Delivering secrets through CI/CD

   • Secrets are stored in protected variables of CI/CD systems (GitLab CI, GitHub Actions, Jenkins).
   • During build/deploy, secrets are injected into the environment.

5. Using HashiCorp Vault API directly

   • Instead of an agent, you can write code that directly accesses Vault to retrieve secrets.

Thus, storing encrypted secrets in Git is usually implemented through file encryption tools (git-crypt, SOPS) with separate key management, and secret delivery is done via secure channels and environment variables in CI/CD without the need for Vault Agent Injector.