Plain Kubernetes Secrets are fine
This was a really interesting article.  One thing I’d like to hear more about would be alternatives to something like Bitnami’s SealedSecrets.<p>The articles mentions that they don’t offer a significant security benefit, but I’d humbly disagree.  They’re not without their downsides, specifically around developer experience and onboarding—not that it’s “bad” when you use them often enough, but for devs who don’t use it often i have faced onboarding challenges.<p>From a security perspective though, if policies are created that give humans less ability to access the plaintext secrets, eg. giving them the ability to create or update sealed secrets but now view or decrypt, isn’t that eliminating, or at least minimizing the least secure aspect of software (humans)?<p>The other benefit, though not necessarily a security benefit, of SealedSecrets is being able to commit your secrets to your VCS, allowing you to deploy your application programmatically rather than have someone manually deploying the secrets.<p>I’m far from a security expert, but to me, being able to minimize the amount of eyes on sensitive materials feels like a net positive.<p>That said, though I’ve overall been pretty happy with it, it’s not without its downsides, and I’d love to get more perspective from people handling this situation in different ways.