secrets

Comprehensive guide to secret management in the homelab Kubernetes platform. Three mechanisms exist for provisioning secrets, each serving a distinct purpose in the lifecycle of credentials.

The mittwald/kubernetes-secret-generator controller watches for annotated Secrets and auto-populates them with random values. Preferred for secrets that do not need to persist across cluster rebuilds.

| autogenerate | Yes | Comma-separated key names | Keys to generate random values for | | encoding | No | hex, base64, base32, raw | Encoding for generated values (default: base64) | | length | No | Integer string (e.g., "32") | Length of generated value (default: "40") |

Secret management patterns for the Kubernetes homelab platform. Covers secret-generator, ExternalSecret, app-secrets module, and cross-namespace replication. Use when: (1) Adding secrets for a new application, (2) Deciding between secret-generator and ExternalSecret, (3) Configuring cross-namespace secret replication, (4) Creating persistent secrets via the app-secrets Terragrunt module, (5) Debugging secret sync failures. Triggers: "secret", "ExternalSecret", "secret-generator", "aws ssm", "parameter store", "kubernetes-replicator", "replicate secret", "app-secrets", "persistent secret", "cross-namespace secret", "secret not syncing", "ClusterSecretStore" Source: ionfury/homelab.