Secrets Management
OpenBao secrets store and Secrets Store CSI Driver for zero-secret GitOps.
Runtime secrets are stored in OpenBao (a Vault-compatible fork) and mounted into pods via the Secrets Store CSI Driver. CDK8s generates zero Secret manifests — all runtime secrets are fetched in-cluster at pod startup.
| Page | What it covers |
|---|---|
| OpenBao | The KV store, unseal sidecar, and day-to-day commands |
| Secrets Store CSI Driver | How the values reach a pod |
The two consumption patterns are explained in Secrets.