Keeping secrets out of Git and out of Argo CD's cache: the operators the project recommends on the destination cluster, the risks of plugin-based injection, and repository credentials.
Syncing secrets from AWS Secrets Manager, Azure Key Vault, Google Secret Manager or Vault into clusters with External Secrets Operator while Argo CD deploys only ExternalSecret references: layout, refresh and health.
Committing encrypted SealedSecret resources that only the in-cluster controller can decrypt: key management and backup, re-sealing on rotation, multi-cluster keys, and the CRD status issue in the Argo CD FAQ.
Delivering Vault or OpenBao secrets to Argo CD-managed workloads with Vault Secrets Operator or External Secrets Operator instead of argocd-vault-plugin: authentication from the cluster, secret paths per environment and rotation.
Mounting secrets from external stores directly into pods with the Secrets Store CSI Driver while Argo CD manages SecretProviderClass resources: when mounts beat synced Secrets, and provider choices per cloud.
The risks of rendering secrets into manifests with argocd-vault-plugin or other Config Management Plugins: plaintext in the Redis cache, exposure through the repo-server, the conflict with rendered manifests, and a migration plan to destination-cluster operators.
Handling Git, Helm and OCI credentials for hundreds of repositories: credential templates by URL prefix, GitHub App authentication, write credentials for the Source Hydrator, and rotating secrets.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.