Latest

Kubernetes Secrets are base64, not encrypted. Here is the full path I use to keep zero secret material inside the cluster — Workload Identity federates a pod to a managed identity, External Secrets Operator pulls live values from Key Vault. Terraform, manifests, pitfalls, all of it.

Every tutorial teaches you the pieces — pods, modules, charts, dashboards. Almost no one teaches the connective tissue between them. That gap is what this blog is about.