Secret Manager can deliver secrets without baking them into images

A Pod identity receives permission to a specific secret, and a CSI integration or application call obtains the current value at runtime.

1Kubernetes ServiceAccountIdentifies the workload through federation.

2IAM policyGrants only the required secret accessor permission.

3Secret ManagerStores versions, rotation history and audit evidence.

4CSI or APIDelivers the value to the Pod at runtime.

5ApplicationReads the mounted file or client response and handles rotation.

A secret mounted as a file is still sensitive inside the Pod; minimize readers and avoid logging it.

Secret Manager can deliver secrets without baking them into images

Secret Manager integration is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. The integration combines workload identity with Secret Manager authorization. Teams can use a CSI path for file-oriented applications or the API for explicit retrieval. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl describe pod checkout -n checkout`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: Rotation semantics differ by integration and application behavior; test whether the process rereads the value or requires restart. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. Sandboxing limits untrusted execution next.