<p>I want to define a Kubernetes secrets map as part of my deployment pipeline. According to the Kubernetes documentation, there are two ways to define a secret.</p>
<ol>
<li>Declarative Using a .yml with the Secret Object</li>
<li>Imperative Using <code>kubectl create secret generic</code></li>
</ol>
<p>The declarative approach requires writing a YAML similar to the one below.</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  username: bXktYXBw
  password: Mzk1MjgkdmRnN0pi
</code></pre>
<p>I want to be able to check in all the Kubernetes YAML files to git so I can run them on a CI server. Checking in the YAML  means that the secret is stored in git which is not good for security. I can put the secret into my CI systems secret's store but then how do I create a secrets YAML that references the OS environment variable at the time that <code>kubectl</code> is called.</p>
<p><strong>Questions:</strong></p>
<ul>
<li>How to define a Kubernetes Secret from within a CI pipeline without having to commit the secrets into source control?</li>
<li>Is there a best practice approach for defining secrets as part of CI for K8s?</li>
</ul>

ams
<p>There is no really good way to managed secrets securely with a vanilla Kubernetes. If you decrypt the secret or inject an unencrypted secret in your CI/CD pipeline and create a Kubernetes Secret, you'll have a decrypted Base64 encoded string to store in your Kubernetes cluster (Etcd).</p>
<p>Most companies I've worked with recently deciding to either keep the secret in their Key Vault and use a Kubernetes controller to inject the secret at runtime or use a controller to be able to manage encrypted secrets like <a href="https://github.com/bitnami-labs/sealed-secrets" rel="nofollow noreferrer">sealed-secrets</a> or <a href="https://github.com/Soluto/kamus" rel="nofollow noreferrer">Kamus</a>. Using encrypted secrets might be a good option if you want to keep your secrets in Git.</p>
<p>First-class support for Hashicorp Vault and Kubernetes : <a href="https://github.com/hashicorp/vault-k8s" rel="nofollow noreferrer">https://github.com/hashicorp/vault-k8s</a></p>
<p>Take a look at this blog post from Banzai Cloud for a more detailed explanation : <a href="https://banzaicloud.com/blog/inject-secrets-into-pods-vault-revisited/" rel="nofollow noreferrer">Inject secrets directly into Pods from Vault revisited</a></p>
