The cloud architect in my team wants to delete every Secret in the Kubernetes cluster and rely exclusively on Vault, using Vault Agent / BankVaults to fetch them.

He argues that Kubernetes Secrets aren’t secure and that keeping them in both places would duplicate information and reduce some of Vault’s benefits. I partially agree regarding the duplicated information.

We’ve managed to remove Secrets for company-owned applications together with the dev team, but we’re struggling with third-party components, because many operators and Helm charts rely exclusively on Kubernetes Secrets, so we can’t remove them. I know about ESO, which is great, but it still creates Kubernetes Secrets, which is not what we want.

I agree with using Vault, but I don’t see why — or how — Kubernetes Secrets must be eliminated entirely. I haven’t found much documentation on this kind of setup.

Is this the right approach ? Should we use ESO for the missing parts ? What am I missing ?

Thank you

I recently came across a post on LinkedIn that stated, 'In DevOps, the line between 'secrets' and 'config' is often blurred.'
I believe there are several ways to enhance secret management in Kubernetes.

Currently, I work a lot with AWS EKS, and I've found several methods to improve the security around secrets. Leveraging tools like Vault, AWS Secrets Manager, Secrets Store CSI Driver, ArgoCD with Vault Plugin, and KMS Encryption can significantly enhance Kubernetes secret management. This aligns with GitOps practices, which often face challenges when it comes to secrets, for better security.
I've written the following two articles that could help:

https://devoriales.com/post/272/boost-security-effective-management-of-kubernetes-secrets-using-aws-secrets-manager
https://devoriales.com/post/329/aws-eks-secret-encryption-securing-your-eks-secrets-at-rest-with-aws-kms

What solutions do you use for dealing with secrets in Kubernetes?

Kubernetes Secrets are just a base64 encoding of some text. If intercepted, it’s easily decoded. Why not encrypt secrets and then just use a ConfigMap? The code running in the container would have to know how to decrypt the secret.

I’d like to hear a little more about good security practices regarding secrets in kubernetes.

Edit: It seems like at the end of the day, you still need TLS everywhere. The Secrets API is more about limiting access via RBAC, not for securely managing sensitive information. Understanding it as an authorization tool makes more sense to me now.