Security Enhancement Strategy through Git Secret Management and Vault Adoption

The goal is to remove secrets stored as plaintext in Git repositories and to completely eliminate base64-encoded Kubernetes Secret objects from the cluster.

Sealed Secrets and SOPS solve the plaintext problem in Git, but have the limitation of ultimately creating Secret objects in the cluster. Vault, on the other hand, manages secrets in an external store and can inject them directly into Pods when needed, satisfying both requirements.

For a successful Vault adoption, the following design considerations must be addressed in advance.

• Storage Backend: Integrated Storage (Raft) is recommended for production environments
• Seal/Unseal Strategy: Auto Unseal configuration is essential for service availability
• Auth Method: Use Kubernetes Auth for K8s environments and AppRole for external systems
• Policy Design: Establish fine-grained HCL policies and path rules based on the principle of least privilege

Secret injection methods include CSI Provider, Vault Agent Injector, AVP (ArgoCD Vault Plugin), and ESO (External Secrets Operator), each with different characteristics depending on whether they create K8s Secrets and whether they support automatic renewal.