Where to Hide Kubernetes Secrets: AWS, Azure, GCP, and On-Prem Compared

Wed, 20 May 2026 22:25:00 -0300

The Kubernetes Secret object is a YAML manifest with a base64-encoded value in it. That’s the entire encryption story. Anyone with get permission on the namespace can read every credential the workload holds. Base64 is not encryption. It is barely obfuscation.

Teams discover this the wrong way — usually during a security review, occasionally during an incident — and the next question is always the same: so where do the real secrets live?

GitOps with Argo CD: The Reconciliation Loop That Survives 3 a.m.

Tue, 19 May 2026 13:30:00 -0300

Here’s the test I use for any deployment tooling:

It is 3 a.m. on a Sunday. PagerDuty just woke you up. A production service is degraded. You roll out of bed, open your laptop, and have to figure out what the cluster thinks is true, what’s actually true, and what changed in the last twelve hours. The faster you can answer those three questions, the better the tooling.

The right GitOps stack collapses all three questions into one dashboard. The wrong one has you SSH-hopping between five servers running kubectl rollout history against unlabeled deployments. I’ve done both. I’m writing this post about the former.

Gitops on Danilo Falcão da Silva

Where to Hide Kubernetes Secrets: AWS, Azure, GCP, and On-Prem Compared

GitOps with Argo CD: The Reconciliation Loop That Survives 3 a.m.