--- title: Managing Secrets in ArgoCD Without Fighting It | daily.dev description: ArgoCD's GitOps model has no native way to handle secrets since Git is the source of truth but secrets shouldn't be stored there in plaintext. Two main... canonical: https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Managing Secrets in ArgoCD Without Fighting It | daily.dev og:description: ArgoCD's GitOps model has no native way to handle secrets since Git is the source of truth but secrets shouldn't be stored there in plaintext. Two main... og:url: https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek og:image: https://api.daily.dev/og/posts/EfDh9GuEK.png og:image:alt: Managing Secrets in ArgoCD Without Fighting It og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Managing Secrets in ArgoCD Without Fighting It **[Infisical](https://daily.dev/sources/infisical)** · 8 min read · 1 upvotes · 0 comments ## Summary ArgoCD's GitOps model has no native way to handle secrets since Git is the source of truth but secrets shouldn't be stored there in plaintext. Two main approaches exist: encryption-based tools like Sealed Secrets and SOPS, which keep encrypted values in Git but burden teams with key management and manual encrypt/decrypt workflows, and external secrets operators like External Secrets Operator (ESO) or Infisical's Kubernetes Operator, which pull secrets from a centralized store at sync time. A key gotcha is covered: generated Kubernetes secrets from these operators need an owner reference (via a creationPolicy field) back to the resource ArgoCD tracks, or ArgoCD's reconciliation will prune them as untracked resources. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why does ArgoCD keep deleting my Kubernetes secret that an external secrets operator creates ArgoCD prunes any resource it doesn't recognize as part of what it applied from Git, and a secret created out-of-band by External Secrets Operator or the Infisical Operator after ArgoCD's sync step lacks that link. Setting the creationPolicy field to Owner attaches an owner reference back to the tracked resource so Kubernetes garbage collection and ArgoCD's resource tracking associate the secret with its source, preventing pruning. _daily.dev surfaces practical GitOps fixes like this for teams debugging flaky ArgoCD secret syncs._ ### what are the tradeoffs between Sealed Secrets and SOPS for encrypting Kubernetes secrets in Git Sealed Secrets encrypts a Secret into a SealedSecret custom resource with a public key, decrypted in-cluster by a controller, but every change requires manually running kubeseal and committing the new output. SOPS encrypts the manifest itself with age or a KMS key and decrypts at apply time via a Kustomize plugin, but requires every engineer to hold the decryption key, produces unreadable diffs in pull requests, and makes key rotation require re-encrypting every file. _Developers weighing GitOps secrets encryption options can track comparisons like this on daily.dev._ ### how does the Infisical Kubernetes Operator sync secrets into ArgoCD-managed clusters The InfisicalStaticSecret custom resource declares a project ID, environment slug, and secret path to fetch from Infisical, referencing an InfisicalAuth resource (which points to an InfisicalConnection) for one-time per-cluster setup. On a configurable refresh interval, the operator pulls the value and writes it into a native Kubernetes Secret, so updates in Infisical propagate without touching Git or ArgoCD directly. _daily.dev helps engineers evaluating centralized secrets managers for Kubernetes stay current on setup patterns._ ## Similar posts on daily.dev - [GitLab Secrets Manager adds ESO, Terraform, API support](https://daily.dev/posts/gitlab-secrets-manager-adds-eso-terraform-api-support-b8lsupnhb) · GitLab · 1 upvotes · 0 comments - [How to Sync AWS Secrets Manager Secrets into Kubernetes with the External Secrets Operator](https://daily.dev/posts/how-to-sync-aws-secrets-manager-secrets-into-kubernetes-with-the-external-secrets-operator-dlh5pprjr) · freeCodeCamp · 0 upvotes · 0 comments - [Solving secret sprawl in multi-account Kubernetes with External Secrets Operator](https://daily.dev/posts/solving-secret-sprawl-in-multi-account-kubernetes-with-external-secrets-operator-z5vx9tlzl) · CNCF · 0 upvotes · 0 comments - [Introducing the external secrets operator for OpenShift](https://daily.dev/posts/introducing-the-external-secrets-operator-for-openshift-nnj9a2pnf) · Red Hat Developer · 0 upvotes · 0 comments - [DevOps isn’t enough: GitOps strategies for regulated multicloud deployments](https://daily.dev/posts/devops-isn-t-enough-gitops-strategies-for-regulated-multicloud-deployments-qabg3ggfw) · All Things Open · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#gitops](https://daily.dev/tags/gitops), [#secrets-management](https://daily.dev/tags/secrets-management), [#argocd](https://daily.dev/tags/argocd) [View this post on daily.dev](https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Managing Secrets in ArgoCD Without Fighting It","url":"https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek"},"datePublished":"2026-10-04T06:43:23.560Z","dateModified":"2026-10-04T06:44:10.486Z","description":"ArgoCD's GitOps model has no native way to handle secrets since Git is the source of truth but secrets shouldn't be stored there in plaintext. Two main...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/147eb6e2855bff46826fe5ac70ab6f4e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/147eb6e2855bff46826fe5ac70ab6f4e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Infisical","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Infisical","logo":"https://media.daily.dev/image/upload/s--cBUOmyKi--/f_auto/v1791096186/squads/35883724-c141-4779-850e-50db106017fd?_a=BAMAMicg0","url":"https://daily.dev/squads/infisical"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,gitops,secrets-management,argocd","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Infisical","item":"https://daily.dev/squads/infisical"},{"@type":"ListItem","position":3,"name":"Managing Secrets in ArgoCD Without Fighting It"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/managing-secrets-in-argocd-without-fighting-it-efdh9guek#faq","mainEntity":[{"@type":"Question","name":"why does ArgoCD keep deleting my Kubernetes secret that an external secrets operator creates","acceptedAnswer":{"@type":"Answer","text":"ArgoCD prunes any resource it doesn't recognize as part of what it applied from Git, and a secret created out-of-band by External Secrets Operator or the Infisical Operator after ArgoCD's sync step lacks that link. Setting the creationPolicy field to Owner attaches an owner reference back to the tracked resource so Kubernetes garbage collection and ArgoCD's resource tracking associate the secret with its source, preventing pruning. daily.dev surfaces practical GitOps fixes like this for teams debugging flaky ArgoCD secret syncs."}},{"@type":"Question","name":"what are the tradeoffs between Sealed Secrets and SOPS for encrypting Kubernetes secrets in Git","acceptedAnswer":{"@type":"Answer","text":"Sealed Secrets encrypts a Secret into a SealedSecret custom resource with a public key, decrypted in-cluster by a controller, but every change requires manually running kubeseal and committing the new output. SOPS encrypts the manifest itself with age or a KMS key and decrypts at apply time via a Kustomize plugin, but requires every engineer to hold the decryption key, produces unreadable diffs in pull requests, and makes key rotation require re-encrypting every file. Developers weighing GitOps secrets encryption options can track comparisons like this on daily.dev."}},{"@type":"Question","name":"how does the Infisical Kubernetes Operator sync secrets into ArgoCD-managed clusters","acceptedAnswer":{"@type":"Answer","text":"The InfisicalStaticSecret custom resource declares a project ID, environment slug, and secret path to fetch from Infisical, referencing an InfisicalAuth resource (which points to an InfisicalConnection) for one-time per-cluster setup. On a configurable refresh interval, the operator pulls the value and writes it into a native Kubernetes Secret, so updates in Infisical propagate without touching Git or ArgoCD directly. daily.dev helps engineers evaluating centralized secrets managers for Kubernetes stay current on setup patterns."}}]} ```