Secrets in Argo CD

• Argo CD itself needs secrets
  • keys for app git repos
  • keys for its own config repo
  • Web UI TLS certs (If you don’t use K8s Certificates Manager)
• Read up on Argo CD’s options for Secrets Management
• Argo CD needs to deploy your apps secrets too (GHA Secrets aren’t an option)
• Tool options I would consider include:
  • Sealed Secrets in Git. Great for small teams with only a few clusters. Hard to scale across dozens of clusters
  • Argo CD Vault Plugin is a specific solution in Argo CD that avoids CRDs (simpler deployment) but only has "all or nothing" access for humans (Supports Vault,AWS,GCP,Azure,SOPS,1Password,Yandex,Keeper,IBM)
  • External Secrets Operator I learned about at GitOpsCon in At KubeCon 2022. Seems great for all.

More on External Secrets Operator

The goal is to add one

Docs on External Secrets Operator

Videos

• Short comparison of Secret solutions: How to Keep a Secret in GitOps, Without Keeping it in Git (15min)
• Manage Kubernetes Secrets With External Secrets Operator by my friend Viktor Farcic (12min)
• KubeCon EU 2023: Protecting Your Crown Jewels with External Secrets Operator (38min)