During a peer review, a developer accidentally committed a YAML manifest containing a plaintext API...

V7.5

Secret Store Service is the purpose-built VCF service for centrally storing, controlling, and distributing sensitive information. It uses OpenBao to protect secrets and supports workloads running directly on Supervisor and within VKS clusters. Kubernetes service accounts authenticate workloads to the service, allowing authorized pods to retrieve or receive secrets dynamically.

The deployment manifest contains a reference to the required secret rather than the plaintext token. This removes sensitive values from Git history, blueprint source, and routine CI/CD output. Access can be restricted according to workload identity and namespace, while secrets can be centrally rotated without editing and recommitting every application manifest.

Secure UI inputs avoid embedding a value in a blueprint but still require manual entry during deployment and do not provide centralized lifecycle management for Supervisor and VKS workloads. Private Git repositories do not make plaintext secret storage safe; repository administrators, compromised credentials, build logs, or historical commits can still expose the values. Environment-variable substitution similarly moves the exposure point into the pipeline rather than eliminating it.

Study Guide references: Installing and Configuring Secret Store Service , Inject Secrets into Pods on VKS Clusters , and Managing Secrets in vSphere Supervisor Workloads .

===============