Secrets in a GitOps World: Scopes, an External Store, and Never a Value in Git
Overview Last week I walked through the Argo CD and Kargo objects a golden-path layer generates, and closed on the thing that wasn’t there: not a single secret anywhere in those manifests. That wasn’t tidy example hygiene. It’s a design position, and this post defends it. The tension is familiar. The GitOps pitch is everything in Git — desired state, reviewable, revertible, reconciled. The security pitch is never commit a secret. The most common resolution is to split the difference: encrypt the secret and commit the ciphertext, with Sealed Secrets or SOPS. It works, lots of good teams do it, and I think it’s the wrong default. ...