What is the best way to manage secrets in a multi-cloud Kubernetes environment?

All answers to this question.

For multi-cloud, HashiCorp Vault is the gold standard, but it has a steep learning curve. If you want something simpler, look at the "External Secrets Operator" (ESO) for Kubernetes. ESO allows you to pull secrets from Azure Key Vault or GCP Secret Manager and inject them into K8s as native secrets. This way, your applications still read them from the standard K8s API, but the "source of truth" remains a high-security hardware security module (HSM) backed service. It’s much easier to manage than running a full Vault cluster yourself across regions.

   Answered 2025-12-20 by Elizabeth Brown

That sounds like a solid middle ground. But if we use the External Secrets Operator, how do we handle secret rotation across different cloud providers simultaneously?

   Answered 2025-12-22 by Richard Davis

• ESO handles rotation quite well, Richard. It polls the provider (Azure/GCP) at a set interval. When you update the secret in the cloud console, the operator detects the change and updates the K8s secret automatically. Most modern apps can then watch for that file change or environment variable update and reload the new credential without needing a full pod restart, depending on how your application code is written.

     Commented 2025-12-24 by Matthew Taylor

Bitnami Sealed Secrets is another option if you want to keep everything in Git. You encrypt the secret with a public key and only the cluster can decrypt it.

   Answered 2025-12-26 by Linda Martinez

• Sealed Secrets is great for GitOps! It’s a very developer-friendly way to manage secrets without needing to grant everyone access to the cloud's Secret Manager.

     Commented 2025-12-28 by Elizabeth Brown