The secrets-management landscape

SOPS, Sealed Secrets, ESO, Vault.

Advanced10 min · lesson 12 of 12

SOPS is one of several answers to “how do we handle secrets,” and they suit different needs. SOPS: encrypt static secrets in Git, simple, GitOps-friendly, key-managed. Sealed Secrets: a Kubernetes controller encrypts Secrets to a cluster-side key so the SealedSecret is safe in Git — k8s-specific, simple. External Secrets Operator (ESO): sync secrets from an external store (Vault, cloud) into k8s Secrets — no secret material in Git at all, just references. Vault: a full secrets platform with dynamic secrets, leasing, and PKI.

Secrets-management approaches

encrypt-in-Git (static)

SOPS

files, any tool, GitOps

Sealed Secrets

k8s-native, cluster key

external source of truth

External Secrets Operator

sync from a store; refs in Git

Vault

dynamic secrets, leasing, PKI

SOPS/Sealed Secrets keep encrypted secrets in Git; ESO/Vault keep the source of truth outside Git entirely.

Choosing (and combining)

Rough guidance: reach for SOPS when you want simple, tool-agnostic encrypted secrets in Git and are comfortable managing a key (ideally via KMS) — it is the low-friction default for GitOps and IaC. Use Sealed Secrets for a pure-Kubernetes, no-extra-infra option. Use ESO or Vault when you want secrets to live outside Git in a dedicated store with rotation, dynamic issuance, and central audit, accepting the operational cost. Many organizations combine them — SOPS for config-adjacent static secrets, Vault for dynamic, high-value credentials.

No tool removes the need to protect the key or the store

Every approach relocates trust rather than eliminating it: SOPS to its decryption key, Sealed Secrets to the controller key, ESO/Vault to the store’s access control and its own root/unseal keys. There is no secrets tool that is “secure by default” without you protecting that root of trust — scope access, audit it, rotate it, and back it up. Choose the tool for your workflow, then invest in guarding whatever key or store it makes central.

The Vault provider & dynamic…Finish · self-test