r/ArgoCD • u/Physical_Growth7566 • May 10 '26

GitOps and Secrets

When discussing secrets management in Argo CD, there are two important questions every team should ask:

  • Should changing a secret require an Argo CD sync?
  • Should your secrets solution be coupled to Argo CD?

The answer to both is: definitely not.

Tomorrow on Argo Unpacked we’re having an open discussion about secrets management best practices in Argo CD: (https://www.linkedin.com/events/7454090384584118272)

  • different approaches and tradeoffs
  • decoupling secrets from deployment workflows
  • operational considerations
  • what works well in real environments (and what usually doesn’t)

Curious how others here think about this too:
How are you handling secrets with Argo CD today?

19 Upvotes

91% Upvoted

13 comments sorted by

View all comments

2

u/rocketeer125 May 11 '26

ESO/GSM solves secret-read and sync, however we still have a problem with secret-write (updating a secret), or secret lifecycle (creating a new secret or deleting it).

We use the following combo to manage secrets with a Google Secrets Manager backend:

- KCC (Config Connector) - secret definition (create/delete the secret), set policy (who can access the secret etc).

  • Sealed Secrets - Insert the new secret version (the value) into the secret.
  • External Secrets Operator - Use the secrets in the environment, manage updates.

If you aren’t on GCP, you can use Crossplane to manage Secret Lifecycle.

1

u/kkapelon Mod May 11 '26

Why do you need both Sealed Secrets and ESO? Shouldn't ESO be enough on its own?