How does Argo CD detect and manage Kubernetes Secrets given that storing plaintext secrets in Git is a bad practice — what are the common patterns?
Quick Answer
Argo CD itself doesn't solve secret encryption — the common patterns layer a separate tool underneath: Sealed Secrets (encrypt secrets client-side so only the cluster's controller can decrypt them, safe to commit encrypted), or an external secrets operator (like External Secrets Operator) that syncs real secret values from a vault/KMS into Kubernetes Secrets at runtime, with Argo CD only ever tracking the reference/policy, not the actual secret value, in Git.
Detailed Answer
GitOps's core premise — Git as the single source of truth, fully readable and diffable — is fundamentally in tension with secrets, which must never be plaintext-readable in Git. Argo CD doesn't natively solve this; it just applies whatever manifests are in Git, so teams need a complementary mechanism.
Sealed Secrets (Bitnami/community project) lets you encrypt a Secret client-side using a public key, producing a SealedSecret custom resource that's safe to commit to Git in plaintext-looking-but-actually-encrypted form; a cluster-side controller holding the matching private key decrypts it into a real Secret only inside the cluster. Argo CD just syncs the SealedSecret manifest like anything else — the encryption/decryption is transparent to it.
External Secrets Operator (and similar tools) take a different approach: Git only contains a reference/policy manifest (which secret path in Vault/AWS Secrets Manager/etc. to pull, and which Kubernetes Secret name to populate), and a controller running in-cluster fetches the actual secret value from the external secret store and creates/updates the real Kubernetes Secret — Argo CD tracks and syncs the reference manifest, never the actual secret value, which never touches Git at all.
Both patterns keep Argo CD's job unchanged (sync manifests from Git) while solving the secret-material problem underneath it; the choice between them usually comes down to whether the org already has a central secrets manager (favoring External Secrets Operator) or wants a simpler, self-contained encrypt-and-commit workflow (favoring Sealed Secrets).
Interview Tip
Be explicit that Argo CD doesn't solve this itself — naming the two concrete patterns (Sealed Secrets vs. External Secrets Operator) and the distinction between them is what the question is really testing.