What is the safest source-control practice for Kubernetes Secret manifests that hold live production credentials?
Select an answer to reveal the explanation.
Short Explanation
Git remembers forever—don't file the vault combination in the repo history. Keep live Secret values out of source control and inject them at deploy time. Base64 in a committed YAML is still a leaked secret waiting to happen.
Full Explanation
Secret manifests with real credentials in data or stringData expose those values to anyone with repository access and to git history. Prefer not storing live secrets in source control; use sealed secrets, external secret stores, or CI/CD injection. Committing plaintext, relying on UID-only stubs, or publishing Secrets publicly increases risk rather than reducing it.