Secrets

What runs

Sealed Secrets. Each secret value is encrypted with the cluster's public key and committed next to the chart that uses it. Only the controller in the cluster can decrypt it.

Why this choice

Secrets live in git with everything else, so a rebuild from git is complete. No one hand-applies secrets, and nothing in the repo is in plain text.

• Sealed per chart, strict scope. A value only decrypts in the namespace and name it was sealed for.

• A chart won't render with a placeholder. A missing secret fails before it reaches the cluster, not at runtime.

• Shared values are paired. When two charts need the same value, the sealing tool seals both together, and the chart checker confirms both exist.

Trade-offs and known limits

• The controller key is the crown jewel. It's the only thing that can decrypt every sealed value, so it's backed up outside the repo and never rotates, which keeps one backup valid. A cluster rebuild restores the key first. Lose it, and every secret has to be resealed with new values.

TODO: is External Secrets in the lab, or on the roadmap?