- No secrets in repo
- Secrets are stored in GCP secret manager
- Terraform can fetch secrets via data
- Terraform can use github secrets via env vars
- terraform.tfvars file should not be commited to repo
- avoid terraform outputs in GitGub Actions
- naming conditions
- conditional access via SA
- Kubernetes CSI secret driver test
- Problems how to create secrets?