Sealed Secrets for One, External Secrets for a Team

thomas@tnepeters.com (Thomas Peters) — Mon, 17 Aug 2026 00:00:00 +0000

The Problem

GitOps has one famous exception: secrets. Everything else in my clusters is a file in git, but credentials can’t be, so every GitOps repo grows a secrets strategy.

I currently run two different ones, on purpose:

Homelab: Sealed Secrets, plus a few gitignored imperative secrets
A team platform I built: External Secrets Operator backed by a self-hosted Vaultwarden organization

This isn’t indecision. It’s the same decision made twice with different inputs. The variable that flips the answer isn’t security or scale of workloads. It’s the number of humans.

Secrets on Thomas Peters

Sealed Secrets for One, External Secrets for a Team

The Problem