Red Hat gathers OpenShift's three secrets operators into one console view

The moment this plug-in is built for is the one where a workload cannot get its credential and the person on call has to work out which of three automations stopped. Red Hat's post makes that argument itself: adopting secrets management at scale moves the failure point off the plain Kubernetes Secret and changes the dependency graph of the workloads using it, so administrators track fewer objects whose health matters much more ^[7].

Teams tell themselves that automating certificate renewal takes certificates off the list of things that can page them. What the automation does is trade a static object for a chain of custom resources. Cert-manager's Issuers and Certificates replaced the job of checking every certificate for its expiry date and issuing a replacement by hand ^[10]. That checking now happens at a higher level: whether the Issuer can still reach the external PKI it was configured against ^[13].

Three operators do the credential work, and all three were generally available before any viewer existed, with the external secrets operator completing the set last year ^[3]. The plug-in is a fourth install, and unlike the other three, its job is inspection rather than issuance ^[2], and it lands as a technology preview through the Red Hat Ecosystem Catalog on a single named release, OpenShift 4.22 ^[2].

The awkward part of the trio is that two of its members disagree about where credentials should live. The external secrets operator manages credentials using Kubernetes Secrets ^[5], while the secrets store CSI driver operator exists for highly secure environments that avoid Kubernetes Secrets entirely ^[6]. A cluster running both has credentials arriving by two paths ^[1], and Red Hat's own blast-radius diagram puts the plain Secret at the worst end of the exposure axis, because nothing rotates or revokes it automatically ^[9].

Measurement is missing from the post: no adoption figure for the three operators, no target date for the plug-in leaving preview, and no support statement past the preview label ^[3]. Red Hat's case is that a unified UI visualising these resources "can be extremely useful" ^[11] - an assertion, not a measured outcome.

The test worth running before installing is to write down the questions you would ask during a credential incident (is a Certificate inside its renewal window and failing, has an ExternalSecret stopped syncing, which workloads mount through the CSI driver) and time how long each takes to answer today. If the answer is a dashboard someone on your team built on the same custom resources, the plug-in mostly buys you one fewer local tool for the next administrator to learn. If the answer is kubectl plus whoever set it up, the preview earns the fourth operator. In neither case does it move you on Red Hat's exposure or severity axes ^[8]; it reports whether the operators that do move you are still running.