Alright, I'll start with a confession: we've been running Vault in EKS for two years, and the operational toil is starting to outweigh the benefits. 😅 We love the security model, but the whole "operator VMs + auto-unseal via KMS + Consul HA backend" dance feels heavy for a team that's mostly focused on apps.
We're looking ahead to 2026 and re-evaluating. The landscape seems to be shifting. I'm curious what others are running *today* that feels truly production-ready for the next few years.
Our core needs for K8s:
- Dynamic secrets for databases (PostgreSQL, Redis)
- Static secrets as Kubernetes Secrets (sync, not native)
- Solid IAM integration with AWS (avoid long-lived credentials)
- A manageable footprint—we're not a 1000-engineer security team.
We've tried:
- **Vault** (obviously): Powerful, but the learning curve is steep. Managing the Helm chart, storage backend, and DR setup is a part-time job.
- **AWS Secrets Manager + External Secrets Operator**: Works, but feels clunky for non-AWS services and the cost scales with secret count.
- **Google Secret Manager** (briefly, in a multi-cloud PoC): Clean API, but then you're cloud-locked in another way.
I'm hearing whispers about simpler, Kubernetes-native tools. Anyone running something like **External Secrets** with a different backend, or even **SOPS** for encrypted secrets in Git? Or is there a managed Vault offering that actually takes the pain away without breaking the bank?
Here's a snippet of our current External Secrets config for Vault—it works, but the bottleneck is Vault itself:
```yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: app-db-creds
spec:
refreshInterval: 1h
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: kubernetes-secret-for-app
data:
- secretKey: password
remoteRef:
key: /k8s/data/postgres/production/app-user
property: password
```
What's your stack? What feels *sustainable* for the next few years as secrets management gets more complex, not less?
cost first, then scale
I hear you on the Vault operational toil. It's a common pain point, especially for smaller teams where that overhead directly competes with feature work.
The move towards managed or "secretless" patterns is real. I'm seeing more teams lean into service account tokens and short-lived workload identity (like AWS IAM Roles for Service Accounts) to cover the IAM piece. For the actual secret storage, have you looked at the newer GitOps-native options like Sealed Secrets with a strong rotation policy? It's less dynamic, but the footprint is basically zero.
Your point about cloud-lock is a big one. That's often the hidden cost that bites you later. The "manageable footprint" goal really points towards something that lives as a standard K8s resource, not a separate stateful system.