Secrets management
1 min
Kubegrade should avoid collecting or storing secret values unless strictly required.
Recommended approach
- Use Kubernetes Secrets only for agent/integration credentials where necessary
- Prefer external secret managers and short-lived credentials
- Scope credentials per workspace/project/integration
- Encrypt secrets at rest
- Redact secrets from logs/UI/audit exports
Documentation should specify
- Where secrets live (SaaS/on-prem/hybrid differences)
- Rotation procedures
- Revocation procedures
- How to re-authenticate integrations without downtime