SOPS + Age and Sealed Secrets for GitOps with ArgoCD

In a recent blog post, a practical approach to managing sensitive information within a GitOps workflow, particularly when utilizing ArgoCD, was outlined. The strategy advocates for a hybrid model, integrating SOPS (Secrets OPerationS) with Age for broader secret encryption and Sealed Secrets for Kubernetes-specific secret management. This combination addresses the distinct needs of secret handling in a modern cloud-native setup. The author explains that SOPS + Age is ideal for encrypting a wide array of files, including critical bootstrapping secrets like `talosconfig` or Proxmox passwords used by Terraform, which exist outside the Kubernetes cluster's direct purview. This ensures that even the initial setup and infrastructure-level secrets are securely stored in Git. The process for updating these secrets is straightforward: modify the encrypted file and reapply it. Once ArgoCD is operational, Sealed Secrets takes over for managing secrets directly within Kubernetes. A significant advantage of Sealed Secrets is its ability to create native Kubernetes objects, which can be easily inspected and managed through standard Kubernetes dashboards and tools. This provides a more integrated and user-friendly experience for in-cluster secrets compared to manually decrypting and encrypting files. A crucial aspect of this strategy is addressing the "gotcha" of Sealed Secrets: a new public/private key pair is generated when the controller is installed, invalidating existing sealed secrets upon a cluster reset. To circumvent this, the author proposes exporting the Sealed Secrets private key, encrypting it with SOPS + Age, and storing it in Git. During a bootstrap process, this encrypted private key can then be imported back into the controller, allowing it to reuse all previously sealed secrets and ensuring seamless recovery and consistency across cluster lifecycles. This method significantly reduces the operational overhead associated with cluster resets in a GitOps environment.