{"id":43211,"date":"2026-05-02T10:00:00","date_gmt":"2026-05-02T08:00:00","guid":{"rendered":"https:\/\/www.cloudmagazin.com\/?p=43211"},"modified":"2026-08-03T15:45:25","modified_gmt":"2026-08-03T13:45:25","slug":"kubernetes-secrets-external-or-sealed-secrets","status":"publish","type":"post","link":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/","title":{"rendered":"Kubernetes Secrets: External or Sealed Secrets?"},"content":{"rendered":"<p style=\"color:#6190a9;font-size:0.9em;margin:0 0 16px;padding:0;\">8 min. read<\/p>\n<p style=\"line-height:1.8;margin-bottom:20px;\"><strong>A Kubernetes Secret stores sensitive values in its default state as nothing more than Base64-encoded text. Anyone who knows where to look can decode those values in seconds. The real danger comes when these Secrets end up in a Git repository, where they persist in the history forever. Two established approaches move secrets out of plaintext without abandoning the GitOps workflow. The right choice depends on where you want the source of truth to live.<\/strong><\/p>\n<h2>Key Takeaways<\/h2>\n<div style=\"background:#f8fbfd;border:1px solid rgba(11,183,253,0.28);border-radius:8px;padding:22px 26px;margin:16px 0 32px 0;\">\n<ul style=\"color:#1a2733\">\n<li><strong>Base64 is not encryption:<\/strong> Kubernetes Secrets are stored in etcd encoded by default, not encrypted. Anyone with access to etcd or the API can read them in plaintext. Real protection only comes from encryption at rest and tightly scoped API permissions.<\/li>\n<li><strong>Plaintext in Git is the expensive mistake:<\/strong> A secret committed even once stays in the history. In 2025 alone, GitGuardian found 28.65 million hardcoded secrets in public repositories &#8211; a third more than the year before.<\/li>\n<li><strong>Source of truth is the deciding factor:<\/strong> External Secrets pulls credentials from an external vault; Sealed Secrets encrypts them for Git. The choice depends on which system should own the secret.<\/li>\n<\/ul>\n<\/div>\n<p style=\"font-size:0.88em;color:#666;margin:20px 0 32px 0;border-top:1px solid #e5e5e5;border-bottom:1px solid #e5e5e5;padding:10px 0;\"><span style=\"color:#004a59;font-weight:700;text-transform:uppercase;font-size:0.72em;letter-spacing:0.14em;margin-right:14px;\">Related:<\/span><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/29\/cloud-native-matures-what-knative-and-kubernetes-1-34-mean-for-ai-workloads\/\" style=\"color:#333;text-decoration:underline;\">Cloud-native matures with Kubernetes 1.34<\/a>&nbsp;&nbsp;<span style=\"color:#ccc;\">\/<\/span>&nbsp;&nbsp;<a href=\"https:\/\/www.cloudmagazin.com\/?p=43022\" style=\"color:#333;text-decoration:underline;\">OpenTofu vs. Terraform<\/a><\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Why a Kubernetes Secret is not actually secret<\/h2>\n<p style=\"line-height:1.8;margin-bottom:20px;\"><strong>What is a Kubernetes Secret?<\/strong> A Kubernetes Secret is an object that separates sensitive data &#8211; passwords, tokens, keys &#8211; from the application configuration. Values are stored Base64-encoded in the central data store etcd by default. Base64 is an encoding scheme, not encryption, which means the Secret is readable in plaintext by anyone with access to etcd or the API.<\/p>\n<p style=\"line-height:1.8;margin-bottom:20px;\">That is precisely where the operational risk begins. Many teams treat the Secret object as protected because the value does not look immediately readable. In practice, the encoding is just a transport format. Without additional measures, the secret is exposed: in etcd, in every API response object, and in every cluster backup that captures state.<\/p>\n<p style=\"line-height:1.8;margin-bottom:20px;\">The first line of defense is therefore encrypting etcd itself, combined with strict API access controls. That protects the secret at rest &#8211; but it does not solve the second, larger problem: how the secret travels into configuration in the first place. That is where the real operational mistake happens.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">When Plaintext Ends Up in Git<\/h2>\n<p style=\"line-height:1.8;margin-bottom:20px;\">GitOps deliberately moves configuration into the repository. Committing the secret along with it is the actual mistake. A secret committed even once remains in the history, even if the next change removes it. Rotating the key doesn&#8217;t eliminate the old secret &#8211; it only adds a second one.<\/p>\n<div style=\"text-align:center;background:#004a59;border-radius:12px;padding:32px 24px;margin:32px 0;\" class=\"evm-stat-highlight\">\n<div style=\"font-size:48px;font-weight:700;color:#0bb7fd;letter-spacing:-0.03em;\">28.65 Million<\/div>\n<div style=\"font-size:15px;color:#fff;margin-top:8px;max-width:440px;margin-left:auto;margin-right:auto;\">new hardcoded secrets were found by GitGuardian in 2025 in public Git repositories alone &#8211; a third more than the previous year.<\/div>\n<div style=\"font-size:12px;color:#0bb7fd;margin-top:8px;\">Source: GitGuardian, State of Secrets Sprawl 2026<\/div>\n<\/div>\n<p style=\"line-height:1.8;margin-bottom:20px;\">This public figure actually understates the internal risk. According to the same analyses, internal repositories contain hardcoded secrets roughly six times more often than public ones &#8211; because the perception of being closed off reduces diligence. The risk doesn&#8217;t fade over time: a significant share of secrets leaked years ago and still valid remains exploitable today. A secret in the Git history is an open risk for as long as it stays valid.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Two Ways Out: External Secrets and Sealed Secrets<\/h2>\n<p style=\"line-height:1.8;margin-bottom:20px;\">Both approaches solve the same problem, but intervene at different points in the workflow. The External Secrets Operator keeps the secret outside the cluster and fetches it on demand. Sealed Secrets encrypts the secret so that no plaintext ever sits in the repository. The deciding factor is which system should own the secret.<\/p>\n<div style=\"overflow-x:auto;-webkit-overflow-scrolling:touch;margin:16px 0 32px 0;\" data-element=\"comparison_table\">\n<table style=\"width:100%;min-width:560px;border-collapse:collapse;font-size:0.95em;\">\n<thead>\n<tr style=\"background:#004a59;color:#fff;\">\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;color:#fff;\">Criterion<\/th>\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;color:#fff;\">External Secrets Operator<\/th>\n<th style=\"padding:12px 16px;text-align:left;border:1px solid #004a59;color:#fff;\">Sealed Secrets<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Source of truth<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">external vault<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">the Git repository<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>What lives in Git<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">a reference only<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">encrypted secret<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Rotation<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">centrally in the vault, automatic<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">re-encrypt and commit again<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Dependency<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">external service must be reachable<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">controller key inside the cluster<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\"><strong>Best suited for<\/strong><\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;\">existing vault, multiple clusters<\/td>\n<td style=\"padding:12px 16px;border:1px solid #ddd;color:#004a59;font-weight:600;\">pure GitOps without an external vault<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p style=\"line-height:1.8;margin-bottom:20px;\">For teams with a central vault such as HashiCorp Vault or a cloud secret manager, the External Secrets Operator is usually the better choice. The secret stays in one place, rotation happens there, and Kubernetes receives only a temporary copy. Teams that want to avoid an external service and keep everything in the repository are well served by Sealed Secrets &#8211; but they must secure and rotate the controller key inside the cluster. The tooling itself also requires upkeep: a vulnerability reported in Sealed Secrets in 2026 shows that even the protective mechanism can become a patch target.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">What Makes or Breaks Secure Secret Management<\/h2>\n<p style=\"line-height:1.8;margin-bottom:20px;\">Whether a practice truly protects or merely feels secure comes down to implementation details. The following patterns separate one from the other.<\/p>\n<div style=\"display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin:28px 0;\" class=\"evm-pros-cons\">\n<div style=\"background:#fafafa;border-top:3px solid #c0392b;padding:18px 20px;border-radius:4px;\">\n<p style=\"margin:0 0 10px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.12em;color:#c0392b;\">What undermines security<\/p>\n<ul style=\"margin:0;padding-left:18px;color:#333;line-height:1.55;font-size:0.95em;\">\n<li style=\"margin-bottom:6px;\">Treating a Base64 secret as protected while leaving etcd unencrypted<\/li>\n<li style=\"margin-bottom:6px;\">Committing secrets once and trusting they&#8217;ll be removed later<\/li>\n<li style=\"margin-bottom:6px;\">Long-lived keys with no rotation and no expiry date<\/li>\n<li>Granting controller or vault access as broadly as regular cluster access<\/li>\n<\/ul>\n<\/div>\n<div style=\"background:#fafafa;border-top:3px solid #2d7a3e;padding:18px 20px;border-radius:4px;\">\n<p style=\"margin:0 0 10px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.12em;color:#2d7a3e;\">What holds up<\/p>\n<ul style=\"margin:0;padding-left:18px;color:#333;line-height:1.55;font-size:0.95em;\">\n<li style=\"margin-bottom:6px;\">Encrypting etcd and strictly limiting API access<\/li>\n<li style=\"margin-bottom:6px;\">Never committing secrets in plaintext, and consistently applying one approach<\/li>\n<li style=\"margin-bottom:6px;\">Short validity periods and automatic rotation as the default<\/li>\n<li>Keeping vault and controller keys separate and tightly scoped<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p style=\"line-height:1.8;margin-bottom:20px;\">The common denominator is a simple principle: a secret is only as secure as its least-protected location. Seeing through Base64, encrypting etcd, and consistently applying one approach takes far less effort than cleaning up after a leaked key. The tools are mature and freely available. What&#8217;s usually missing is simply the decision to take the secret more seriously than its encoding.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<details>\n<summary><strong>Are Kubernetes Secrets encrypted?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Not by default. Values are stored Base64-encoded in etcd, and Base64 is an encoding, not encryption. Anyone with access to etcd or the API can read them in plain text. True encryption at rest must be enabled separately for etcd, alongside strict access controls.<\/p>\n<\/details>\n<details>\n<summary><strong>What does the External Secrets Operator do?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">It reads secrets from an external vault such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault, then automatically creates native Kubernetes Secrets from them. The source of truth stays in the vault; the cluster holds only a synchronised copy. The repository contains nothing but a reference &#8211; never the secret itself.<\/p>\n<\/details>\n<details>\n<summary><strong>How do Sealed Secrets work?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">A secret is encrypted with a public key that only a controller inside the cluster can decrypt. The encrypted object can safely be committed to the Git repository. When applied in the cluster, the controller decrypts it into a regular Secret. This keeps true GitOps possible without ever storing a secret in plain text.<\/p>\n<\/details>\n<details>\n<summary><strong>Which approach is the right one?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">It depends on where the source of truth should live. If a central vault already exists and multiple clusters are in play, the External Secrets Operator is the better fit. If everything should stay in the repository with no external service required, Sealed Secrets are the simpler path. Both are well-established &#8211; the difference comes down to where the secret resides.<\/p>\n<\/details>\n<details>\n<summary><strong>What about secrets that are already in Git?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">They are considered compromised and must be rotated &#8211; not just removed. Deleting them from the current version leaves the secret behind in history. The only safe course of action is to invalidate the affected key or password, reissue it, and then migrate the workflow to one of the two clean approaches.<\/p>\n<\/details>\n<div style=\"margin:40px 0 24px 0;\">\n<p style=\"margin:0 0 12px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.18em;color:#666;\">More from the MBF Media Network<\/p>\n<div style=\"padding:14px 18px;border-left:3px solid #202528;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#202528;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">mybusinessfuture<\/div>\n<p><a href=\"https:\/\/mybusinessfuture.com\/make-or-buy-ki-mittelstand-selbst-bauen-einkaufen\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">Make or Buy for AI: Build It Yourself or Purchase It<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #d65663;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#d65663;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">digital-chiefs<\/div>\n<p><a href=\"https:\/\/www.digital-chiefs.de\/managed-security-services-ciso-compliance-nis2-haftung\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">Why the CISO Shouldn&#8217;t Bear the Compliance Burden Alone<\/a><\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #69d8ed;background:#fafafa;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#69d8ed;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">securitytoday<\/div>\n<p><a href=\"https:\/\/www.securitytoday.de\/2026\/06\/05\/backup-ransomware-3-2-1-1-0-restore-test\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">Backup That Survives a Ransomware Attack<\/a><\/p>\n<\/div>\n<\/div>\n<p style=\"text-align:right;color:#868e96;font-size:0.85em;margin-top:48px;\"><em>Image credit: Title image AI-generated (June 2026), C2PA certificate embedded in image<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Kubernetes secrets are only Base64 encoded, not encrypted. How External Secrets and Sealed Secrets keep secrets secure in plaintext and safely out of Git.","protected":false},"author":31,"featured_media":43105,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[929],"tags":[],"industry":[],"class_list":["post-43211","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cm-guides"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":43104,"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Kubernetes Secrets: External or Sealed Secrets?<\/title>\n<meta name=\"description\" content=\"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kubernetes Secrets: External or Sealed Secrets?\" \/>\n<meta property=\"og:description\" content=\"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/\" \/>\n<meta property=\"og:site_name\" content=\"cloudmagazin\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudmagazincom\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-02T08:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-03T13:45:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1792\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alec Chizhik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:site\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alec Chizhik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/\"},\"author\":{\"name\":\"Alec Chizhik\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\"},\"headline\":\"Kubernetes Secrets: External or Sealed Secrets?\",\"datePublished\":\"2026-05-02T08:00:00+00:00\",\"dateModified\":\"2026-08-03T13:45:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/\"},\"wordCount\":1268,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg\",\"articleSection\":[\"Guides\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/\",\"name\":\"Kubernetes Secrets: External or Sealed Secrets?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg\",\"datePublished\":\"2026-05-02T08:00:00+00:00\",\"dateModified\":\"2026-08-03T13:45:25+00:00\",\"description\":\"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg\",\"width\":1792,\"height\":1024,\"caption\":\"Hands-on-Arbeit am Serverrack: Kabel, Ports und Notizen im Rechenzentrum.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/05\\\/02\\\/kubernetes-secrets-external-or-sealed-secrets\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kubernetes Secrets: External or Sealed Secrets?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"name\":\"cloudmagazin\",\"description\":\"Inspiration f\u00fcr Businessentscheider\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\",\"name\":\"cloudmagazin\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"width\":150,\"height\":150,\"caption\":\"cloudmagazin\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cloudmagazincom\\\/\",\"https:\\\/\\\/x.com\\\/cloudmagazin\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/cloudmagazin\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\",\"name\":\"Alec Chizhik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"caption\":\"Alec Chizhik\"},\"description\":\"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/alecchizhik\\\/\"],\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/author\\\/alec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kubernetes Secrets: External or Sealed Secrets?","description":"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/","og_locale":"en_US","og_type":"article","og_title":"Kubernetes Secrets: External or Sealed Secrets?","og_description":"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.","og_url":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/","og_site_name":"cloudmagazin","article_publisher":"https:\/\/www.facebook.com\/cloudmagazincom\/","article_published_time":"2026-05-02T08:00:00+00:00","article_modified_time":"2026-08-03T13:45:25+00:00","og_image":[{"width":1792,"height":1024,"url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg","type":"image\/jpeg"}],"author":"Alec Chizhik","twitter_card":"summary_large_image","twitter_creator":"@cloudmagazin","twitter_site":"@cloudmagazin","twitter_misc":{"Written by":"Alec Chizhik","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#article","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/"},"author":{"name":"Alec Chizhik","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c"},"headline":"Kubernetes Secrets: External or Sealed Secrets?","datePublished":"2026-05-02T08:00:00+00:00","dateModified":"2026-08-03T13:45:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/"},"wordCount":1268,"publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg","articleSection":["Guides"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/","url":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/","name":"Kubernetes Secrets: External or Sealed Secrets?","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg","datePublished":"2026-05-02T08:00:00+00:00","dateModified":"2026-08-03T13:45:25+00:00","description":"Kubernetes secrets are just Base64, not encrypted. Why plaintext in Git is the costly mistake and how External Secrets and Sealed Secrets protect.","breadcrumb":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#primaryimage","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/kubernetes-secrets-external-secrets-sealed-secrets-plaintext-cover-hero.jpg","width":1792,"height":1024,"caption":"Hands-on-Arbeit am Serverrack: Kabel, Ports und Notizen im Rechenzentrum."},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/05\/02\/kubernetes-secrets-external-or-sealed-secrets\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudmagazin.com\/en\/home\/"},{"@type":"ListItem","position":2,"name":"Kubernetes Secrets: External or Sealed Secrets?"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudmagazin.com\/en\/#website","url":"https:\/\/www.cloudmagazin.com\/en\/","name":"cloudmagazin","description":"Inspiration f\u00fcr Businessentscheider","publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudmagazin.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudmagazin.com\/en\/#organization","name":"cloudmagazin","url":"https:\/\/www.cloudmagazin.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","width":150,"height":150,"caption":"cloudmagazin"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cloudmagazincom\/","https:\/\/x.com\/cloudmagazin","https:\/\/www.linkedin.com\/showcase\/cloudmagazin\/"]},{"@type":"Person","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c","name":"Alec Chizhik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","caption":"Alec Chizhik"},"description":"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.","sameAs":["https:\/\/www.linkedin.com\/in\/alecchizhik\/"],"url":"https:\/\/www.cloudmagazin.com\/en\/author\/alec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/43211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/comments?post=43211"}],"version-history":[{"count":3,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/43211\/revisions"}],"predecessor-version":[{"id":50420,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/43211\/revisions\/50420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media\/43105"}],"wp:attachment":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media?parent=43211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/categories?post=43211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/tags?post=43211"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/industry?post=43211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}