Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Sealed Secrets, External Secrets Operator (ESO), and Vault solve different parts of Kubernetes secrets management. Sealed Secrets lets you commit encrypted secret values to Git; ESO retrieves values from an external provider and synchronizes them into Kubernetes Secrets; Vault is a secret-management platform with several ways to deliver credentials to workloads. Choose based on where the source of truth should live, whether Kubernetes Secret objects are acceptable, how credentials must rotate, and what your team can operate.
How do secrets fit into a GitOps workflow?
GitOps keeps the desired configuration for a cluster in version control and reconciles that configuration into the cluster. Secret handling adds a choice: store encrypted values in Git, store references in Git while values remain with a provider, or use a secret platform such as Vault and choose how workloads consume its values.
As an Amazon Associate I earn from qualifying purchases.
Those choices affect different parts of the system. A sealed manifest, an external-secret reference, and a Vault integration are not interchangeable product versions. In particular, Vault is a platform; Vault Secrets Operator (VSO) is one way to connect it to Kubernetes.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow do the three approaches differ?
| Approach | Where the value lives | What reaches Kubernetes | Main operational responsibility |
|---|---|---|---|
| Sealed Secrets | Encrypted ciphertext is represented in a SealedSecret that can be committed to Git. The controller holds the private key needed to decrypt it. | The controller decrypts the SealedSecret into a native Kubernetes Secret. | Protect and back up the controller key; rotate the actual credentials and reseal updated values. |
| External Secrets Operator | The secret value stays in an external provider. Git and Kubernetes hold references and synchronization configuration. | ESO reads provider values and creates or updates native Kubernetes Secret objects according to the ExternalSecret configuration. | Protect provider credentials, constrain provider and Kubernetes permissions, and set refresh and deletion behavior deliberately. |
| Vault | Vault provides a secret-management platform or service; the selected engine and integration determine how values are managed and delivered. | VSO can synchronize supported values into Kubernetes Secrets. CSI and Agent Injector are alternative integration patterns. | Operate or procure Vault, secure its authentication and policies, and secure the selected workload-delivery path. |
This is an architectural comparison, not a ranking: documented mechanisms do not establish a universal difference in cost, performance, staffing, or security. The Sealed Secrets, ESO, HashiCorp Vault, and OWASP DevSecOps documentation reviewed on October 7, 2026 describes the mechanisms; mutable “latest” documentation may change, so verify details against the versions and provider integrations you deploy.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When should you use Sealed Secrets?
Consider Sealed Secrets when you want encrypted secret manifests alongside the rest of your GitOps configuration and can manage the controller’s key lifecycle. The kubeseal client encrypts material for the controller, which decrypts it in the target cluster. The Git copy is ciphertext, but the resulting Kubernetes Secret is still governed by Kubernetes access controls.
Scope the sealed value to its intended destination
By default, strict scope binds decryption to both the Secret name and namespace. Namespace-wide scope binds it to the namespace, while cluster-wide scope uses an empty label and is more permissive. The Sealed Secrets cryptography guide describes AES-256-GCM for the payload and RSA-OAEP with SHA-256 to protect a one-time session key; in strict scope, the Secret name and namespace are included in the OAEP label. Use a broader scope only when its portability is worth the weaker placement constraint.
Sealing does not authenticate the person who submits a SealedSecret. The project documentation makes this point explicitly: the surrounding Git workflow, who may change or approve manifests, and Kubernetes RBAC must restrict which resources get applied. Ciphertext in Git is not a substitute for access control around deployment.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Back up the controller key—and rotate credentials separately
The controller’s private key is a recovery dependency: if the key used to encrypt a SealedSecret is lost, operators may need to recreate the credential and seal it again. Backups therefore need especially strong protection because anyone who obtains the key may gain decryption capability.
Renewing a sealing key does not change the password, token, or certificate stored as the secret value. As the Sealed Secrets project documentation puts it, “SealedSecret key renewal and re-encryption features are not a substitute for periodical rotation of your actual secret values.” When an application credential changes, update the value and reseal it; do not treat key renewal as credential rotation.
When should you use External Secrets Operator?
Consider ESO when a provider already holds your source values and you want Kubernetes-native declarations describing which values to retrieve and how to map them. An ExternalSecret can map individual provider entries through spec.data or retrieve broader sets through spec.dataFrom. ESO then reconciles the configured values into a Kubernetes Secret.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Choose refresh behavior to match the credential lifecycle
ESO’s refreshPolicy determines when it fetches provider values. Periodic is the default and can be paired with a configurable refresh interval. CreatedOnce creates the target once, while OnChange reacts to changes to the ExternalSecret’s metadata or specification. With Periodic, a zero refresh interval creates the target once and does not periodically update it. Set the policy and interval to match the provider and application’s rotation needs, rather than assuming every source change appears immediately in a workload.
Check the provider integration and deletion policy as well as refresh settings. These choices govern how the controller handles provider values and target objects, and their behavior can depend on the configured integration.
Separate protection of the provider from protection of the cluster copy
Keeping values out of Git does not mean plaintext is absent from the cluster: in the synchronization pattern described here, ESO writes the value into a native Kubernetes Secret. Protect the external provider and its access credentials, then separately constrain access to the ESO controller, its provider permissions, and the resulting Kubernetes objects. OWASP’s DevSecOps guidance frames ESO as a reference to a central store and Sealed Secrets as ciphertext held in Git; the actual exposure depends on how each deployment is configured.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Do you need Vault for Kubernetes secrets?
Vault is a fit when you need a centralized secret-management platform, Vault-managed credentials, or a Vault integration—and can support its operational model. It can run in Kubernetes or be used as an external service. Vault Secrets Operator is only one delivery option: HashiCorp also documents a Secrets Store CSI provider and Vault Agent Injector.
VSO synchronizes supported sources into Kubernetes Secret resources. If your requirement is to avoid native Kubernetes Secrets, do not assume that VSO’s sync pattern meets it: assess CSI or agent-based delivery and verify that your application can consume the resulting files or tokens.
Understand the scope of Vault’s lease behavior
Vault’s Kubernetes Secrets Engine can generate service-account tokens and optionally create service accounts, role bindings, and roles. Tokens have configurable TTLs, and Kubernetes objects created by that engine are automatically deleted when the Vault lease expires. The engine must be configured first, and Vault’s service account needs appropriate Kubernetes permissions.
That lifecycle applies to the documented Kubernetes Secrets Engine behavior, not automatically to every Vault secret type or every VSO workflow. Choose an integration based on the credential type and the application’s consumption and rotation requirements.
How should you choose?
- Choose Sealed Secrets if encrypted manifests in Git are important and your team can protect the controller key, recover from its loss, and reseal values when credentials rotate.
- Choose ESO if an external provider is already the source of truth and you want declarative Kubernetes references with synchronization. Decide whether the resulting Kubernetes Secret objects are acceptable, then set refresh, deletion, and access policies.
- Choose Vault if a centralized secret platform or Vault-specific capability is required and your team can operate or procure it. Select VSO, CSI, Agent Injector, or another supported path according to whether a Kubernetes Secret object is acceptable and how the application consumes credentials.
Before committing to a pattern, answer four questions: Where should the authoritative value live? Is a Kubernetes Secret object an acceptable delivery target? What must happen when a value rotates or a lease expires? Which team owns the provider credentials, controller keys, policies, permissions, and recovery procedures? The answers determine where the operational burden and trust boundaries belong; the documented capabilities alone do not establish a one-size-fits-all security or cost winner.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
