Question: can kubernetes keep a secret?
Answer: Both solutions let you create encrypted secrets that can be committed to source control, and decryption to regular Kubernetes secrets occurs later on (either on the CD or in the cluster). ... There's no support for one-time encryption because in order to modify a value in the secret, you must decrypt its content.