Secrets on Support Tools

10 Practical Tips to Tame Kubernetes

Tue, 01 Jul 2025 00:00:00 -0500

Kubernetes is a powerful tool for managing containerized workloads—but with great power comes great complexity. Whether you’re just starting with Kubernetes or looking to tighten up your production clusters, these 10 practical tips (plus a bonus) will help you reduce pain, improve resilience, and simplify day-to-day operations.

GitHub Actions Secrets: OIDC, Environments, SHA Pins

Sun, 25 May 2025 16:34:42 -0500

Most GitHub Actions secret leaks are not clever. A long-lived AWS key sits in repository secrets for three years, a pull_request_target workflow checks out a fork and runs its npm install with that key in the environment, or a tag on a popular action gets repointed to malicious code. This guide fixes each of those with concrete workflow YAML, in the order that removes the most risk first.

Extract a Kubernetes Secret From an etcd Snapshot

Fri, 18 Oct 2024 19:26:00 -0500

Someone deleted a Secret, or overwrote it, and the only copy left is in an etcd snapshot. Restoring the whole cluster to get one object back would roll every other resource back too. This guide restores the snapshot into a scratch etcd that has nothing to do with the live cluster, reads the one key you need, and decodes it into normal Secret YAML.

Helm: Create a Secret Only If It Does Not Exist (lookup)

Mon, 07 Oct 2024 19:26:00 -0500

Kubernetes Secrets are an essential part of securing sensitive information such as passwords, API keys, and certificates. When using Helm to manage your Kubernetes deployments, there are often cases where you need to reuse existing Secrets rather than creating new ones. This is a common requirement in scenarios where Secrets are managed externally or shared across multiple applications.

In this post, we will explore how to reuse existing Kubernetes Secrets within your Helm templates, ensuring efficient management and security for your workloads.

Decrypt One Secret From an RKE2 etcd Snapshot

Wed, 04 Sep 2024 04:48:35 -0500

Someone deleted a Secret, or rotated a credential and lost the old value, and the only copy left is in last night’s RKE2 etcd snapshot. Restoring the whole cluster to get one object back is out of the question. This guide restores the snapshot into a scratch etcd that has nothing to do with the live cluster, reads the one key you need, and decrypts it, because on RKE2 every Secret in etcd is encrypted at rest.