I'm setting up GitOps for the first time, and the advice I've seen says it's perfectly normal to keep all deployment manifests in a single repository. That setup works for me so far, but I'm uncomfortable with the idea of putting all of our Kubernetes secrets in the same Git repository. I learned early on never to commit .env files or plaintext credentials, so I'm trying to understand the usual way GitOps handles secrets. Should secrets live elsewhere, be encrypted in Git, or should the repository structure be different?
4 Answers
The number of repositories is mostly a workflow and ownership decision, not a security requirement. A monorepo is fine if access and reviews are managed well; separate service repositories can make sense when teams need independent ownership. Either way, keep sensitive values in a proper secret manager or use a well-designed encryption tool rather than committing them directly.
A single deployment repository can be completely reasonable, especially for a small team or while learning. The important part is that it should not contain plaintext secrets. Store credentials in something like Vault, AWS Secrets Manager, Azure Key Vault, or another secret manager, then reference them from the manifests using External Secrets Operator. The cluster can pull the actual values without exposing them in Git.
Another common option is SOPS, which encrypts secret files before they are committed. Sealed Secrets is also widely used: you commit an encrypted Kubernetes Secret, and only the target cluster can decrypt it. Base64-encoded YAML is not encryption, so that alone does not protect anything.
Some setups retrieve secrets during deployment instead of at runtime. A privileged CI or CD system pulls values from the secret store and creates or updates the Kubernetes Secret. That avoids managing encrypted values in Git, though it means the deployment system needs carefully limited access and a reliable process for handling secret changes.
So the repository can contain an encrypted representation, but not the actual credentials or encryption keys?