--- title: Kubernetes Secrets Management: Architecture, Tools, and... description: Kubernetes secrets management is explained from architecture down to implementation: native Secret objects are base64-encoded, not encrypted, sit in etcd, and... canonical: https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes Secrets Management: Architecture, Tools, and Best Practices | daily.dev og:description: Kubernetes secrets management is explained from architecture down to implementation: native Secret objects are base64-encoded, not encrypted, sit in etcd, and... og:url: https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9 og:image: https://api.daily.dev/og/posts/APhvp2fr9.png og:image:alt: Kubernetes Secrets Management: Architecture, Tools, and Best Practices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Secrets Management: Architecture, Tools, and Best Practices **[Infisical](https://daily.dev/sources/infisical)** · 17 min read · 1 upvotes · 0 comments ## Summary Kubernetes secrets management is explained from architecture down to implementation: native Secret objects are base64-encoded, not encrypted, sit in etcd, and are readable by anyone who can create a pod in a namespace. Three storage approaches are compared: native plaintext secrets, encrypted secrets in Git via Sealed Secrets or SOPS, and external secrets managers. Two delivery mechanisms are covered: the native Secret object path (via External Secrets Operator or the Infisical Kubernetes Operator) versus runtime CSI mounts that bypass etcd entirely. A worked example configures the Infisical Kubernetes Operator using InfisicalConnection, InfisicalAuth, and InfisicalStaticSecret CRDs, including how rotation reaches running pods for env vars versus volume mounts, plus an FAQ on encryption, rotation behavior, and namespace scoping. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Are Kubernetes Secrets encrypted by default? No, Kubernetes Secret objects are base64-encoded by default, not encrypted, so anyone holding the manifest can read the value in plaintext. They sit unencrypted in etcd unless an EncryptionConfiguration is configured on the API server, and even with encryption at rest, the value is decrypted whenever served through the API. _daily.dev surfaces practical guidance like this for teams hardening their secrets management setup._ ### What happens to environment variable secrets in a Kubernetes pod when the secret value rotates? Environment variables resolve once at container start and the running process holds that value until it dies, so a rotation never reaches an already-running pod through env vars. Volume mounts, by contrast, are updated in place by the kubelet, though the rotated value only takes effect if the application re-reads the file instead of caching it at startup. _Engineers debugging stale credentials after a rotation can track details like this on daily.dev._ ### What is the difference between Sealed Secrets and SOPS for encrypting Kubernetes secrets in Git? Sealed Secrets runs a controller inside the cluster holding a private key, so a SealedSecret encrypted for one cluster cannot be decrypted by another without re-encrypting. SOPS instead encrypts the file against an external key such as AWS KMS, GCP KMS, age, or PGP, so the same encrypted file works across clusters but requires decryption in CI or via an operator at deploy time. _Teams weighing GitOps secret encryption options can compare approaches like this on daily.dev._ ## Similar posts on daily.dev - [How to Sync AWS Secrets Manager Secrets into Kubernetes with the External Secrets Operator](https://daily.dev/posts/how-to-sync-aws-secrets-manager-secrets-into-kubernetes-with-the-external-secrets-operator-dlh5pprjr) · freeCodeCamp · 0 upvotes · 0 comments - [Day 62: Manage Secrets in Kubernetes.Stop Hardcoding Passwords Like It’s 2005](https://daily.dev/posts/day-62-manage-secrets-in-kubernetes-stop-hardcoding-passwords-like-it-s-2005-bi8f2yo52) · Medium · 1 upvotes · 0 comments - [Kubernetes Secrets and ConfigMaps in 2026: the Secret is the last mile](https://daily.dev/posts/kubernetes-secrets-and-configmaps-in-2026-the-secret-is-the-last-mile-cq5l9gosq) · Giant Swarm · 11 upvotes · 0 comments - [Introducing the external secrets operator for OpenShift](https://daily.dev/posts/introducing-the-external-secrets-operator-for-openshift-nnj9a2pnf) · Red Hat Developer · 0 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-kqhena7w8) · Medium · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes), [#gitops](https://daily.dev/tags/gitops), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes Secrets Management: Architecture, Tools, and Best Practices","url":"https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9"},"datePublished":"2026-10-04T06:43:22.533Z","dateModified":"2026-10-04T06:43:47.328Z","description":"Kubernetes secrets management is explained from architecture down to implementation: native Secret objects are base64-encoded, not encrypted, sit in etcd, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f11b11107ae7221751c187790434bd7d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f11b11107ae7221751c187790434bd7d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Infisical","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Infisical","logo":"https://media.daily.dev/image/upload/s--cBUOmyKi--/f_auto/v1791096186/squads/35883724-c141-4779-850e-50db106017fd?_a=BAMAMicg0","url":"https://daily.dev/squads/infisical"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,kubernetes,gitops,secrets-management","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Infisical","item":"https://daily.dev/squads/infisical"},{"@type":"ListItem","position":3,"name":"Kubernetes Secrets Management: Architecture, Tools, and Best Practices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-secrets-management-architecture-tools-and-best-practices-aphvp2fr9#faq","mainEntity":[{"@type":"Question","name":"Are Kubernetes Secrets encrypted by default?","acceptedAnswer":{"@type":"Answer","text":"No, Kubernetes Secret objects are base64-encoded by default, not encrypted, so anyone holding the manifest can read the value in plaintext. They sit unencrypted in etcd unless an EncryptionConfiguration is configured on the API server, and even with encryption at rest, the value is decrypted whenever served through the API. daily.dev surfaces practical guidance like this for teams hardening their secrets management setup."}},{"@type":"Question","name":"What happens to environment variable secrets in a Kubernetes pod when the secret value rotates?","acceptedAnswer":{"@type":"Answer","text":"Environment variables resolve once at container start and the running process holds that value until it dies, so a rotation never reaches an already-running pod through env vars. Volume mounts, by contrast, are updated in place by the kubelet, though the rotated value only takes effect if the application re-reads the file instead of caching it at startup. Engineers debugging stale credentials after a rotation can track details like this on daily.dev."}},{"@type":"Question","name":"What is the difference between Sealed Secrets and SOPS for encrypting Kubernetes secrets in Git?","acceptedAnswer":{"@type":"Answer","text":"Sealed Secrets runs a controller inside the cluster holding a private key, so a SealedSecret encrypted for one cluster cannot be decrypted by another without re-encrypting. SOPS instead encrypts the file against an external key such as AWS KMS, GCP KMS, age, or PGP, so the same encrypted file works across clusters but requires decryption in CI or via an operator at deploy time. Teams weighing GitOps secret encryption options can compare approaches like this on daily.dev."}}]} ```