How did you manage confidential data (secrets) in conjunction with Argo CD?
sobes.tech AI
Answer from AI
The following practices are commonly used for managing confidential data (secrets) in conjunction with Argo CD:
-
Using external secret stores — such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault. Argo CD integrates with them via plugins or external tools.
-
Sealed Secrets — a special controller that encrypts secrets in Kubernetes manifests, allowing them to be stored in Git in encrypted form. Argo CD applies them by decrypting in the cluster.
-
SOPS (Secrets OPerationS) — a tool for encrypting YAML/JSON secret files. Files are stored in Git in encrypted form, and Argo CD decrypts them using plugins or Kustomize.
-
Kustomize with secrets — Kustomize can be used to generate secrets, but they should be stored in encrypted form or in secure separate locations.
Example of using SOPS with Argo CD:
- Secrets are encrypted with SOPS and stored in Git.
- Argo CD is configured with a plugin that decrypts secrets before application.
Thus, secrets are not stored in plain text in the repository and are securely delivered to the cluster.
It is also important to restrict access to Argo CD and repositories, and to use RBAC and auditing to control secret management.