0Pricing
Docker & Kubernetes for Developers · Lesson

Managing Secrets Securely with External Secret Stores

Stop committing plaintext Secrets and integrate Kubernetes with external vaults like HashiCorp Vault using the External Secrets Operator.

Managing Secrets Securely with External Secret Stores is a free Docker & Kubernetes for Developers lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Docker & Kubernetes for Developers learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Kubernetes Secrets Are Only Encoded

By default a Kubernetes Secret is just base64-encoded, not encrypted. Anyone with API access or etcd access can read it unless extra protection is added.

Encryption at Rest

A first step is enabling encryption at rest in the API server so Secret data is encrypted before being written to etcd.

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources: ["secrets"]
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-key>

The Git Problem

In GitOps, committing Secret YAML to a repo leaks credentials. We need secrets that live outside git but still flow into the cluster.

External Secret Stores

Tools like HashiCorp Vault, AWS Secrets Manager, and GCP Secret Manager store secrets centrally with auditing, rotation, and fine-grained access.

The External Secrets Operator

The External Secrets Operator (ESO) syncs values from an external store into native Kubernetes Secrets, so workloads consume them normally.

Defining a SecretStore

A SecretStore tells ESO how to authenticate to the backend.

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: https://vault.example.com
      path: secret
      auth:
        kubernetes:
          role: my-app

Defining an ExternalSecret

An ExternalSecret maps a key in the store to a generated Kubernetes Secret.

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-creds
spec:
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: db-creds
  data:
    - secretKey: password
      remoteRef:
        key: database/prod
        property: password

Automatic Rotation

ESO refreshes synced secrets on an interval, so rotating a value in Vault propagates into the cluster without redeploys.

spec:
  refreshInterval: 1h

Sealed Secrets Alternative

If you must keep secrets in git, Sealed Secrets encrypts them with a cluster-only key, producing a safe-to-commit SealedSecret that only the controller can decrypt.

Limiting Access With RBAC

Restrict who can read Secrets using RBAC, and prefer mounting secrets as files over environment variables to reduce accidental logging.

Avoiding Leaks

Never echo secrets in logs or CI output, and add secret-scanning to your pipeline to catch accidental commits.

Quick Check

Test what you have learned.

Recap

You learned that Secrets are only base64-encoded, how encryption at rest helps, and how the External Secrets Operator syncs from Vault and similar stores, plus Sealed Secrets, rotation, and RBAC to keep credentials safe.

Frequently asked questions

Is the “Managing Secrets Securely with External Secret Stores” lesson free?

Yes — the full text of “Managing Secrets Securely with External Secret Stores” is free to read here on the web, and the Docker & Kubernetes for Developers course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Docker & Kubernetes for Developers course, upgrade to CoddyKit PRO.

What will I learn in “Managing Secrets Securely with External Secret Stores”?

Stop committing plaintext Secrets and integrate Kubernetes with external vaults like HashiCorp Vault using the External Secrets Operator. You practise Docker & Kubernetes for Developers with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Docker & Kubernetes for Developers?

No prior experience is required. Docker & Kubernetes for Developers on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Managing Secrets Securely with External Secret Stores” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Docker & Kubernetes for Developers lesson?

Yes. Every Docker & Kubernetes for Developers lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Role-Based Access Control (RBAC)
  2. Pod Security & Image Scanning
  3. Securing Kubernetes Network Traffic
  4. Managing Secrets Securely with External Secret Stores
← Back to Docker & Kubernetes for Developers