Secrets in a GitOps World: Scopes, an External Store, and Never a Value in Git

Fri, 07 Aug 2026 09:00:00 +0530

Overview

Last week I walked through the Argo CD and Kargo objects a golden-path layer generates, and closed on the thing that wasn’t there: not a single secret anywhere in those manifests. That wasn’t tidy example hygiene. It’s a design position, and this post defends it.

The tension is familiar. The GitOps pitch is everything in Git — desired state, reviewable, revertible, reconciled. The security pitch is never commit a secret. The most common resolution is to split the difference: encrypt the secret and commit the ciphertext, with Sealed Secrets or SOPS. It works, lots of good teams do it, and I think it’s the wrong default.

Security on rtnpro

Secrets in a GitOps World: Scopes, an External Store, and Never a Value in Git

Overview