Account Executive - SMB

Managing secrets securely in Kubernetes with 1Password. 02.09.2026 Reading time: 4 mins. Last Updated: 02.09.2026 Table of contents. Managing secrets securely in Kubernetes is a critical challenge for modern cloud-native environments. Application credentials, certificates, private keys, and passwords must be handled in a way that is secure, auditable, and operationally flexible - especially when regular rotation is required. By integrating 1Password with Kubernetes using the External Secrets Operator (ESO), teams can centralize secret management while keeping sensitive data out of Git repositories and Kubernetes manifests. This approach enables Kubernetes workloads to consume secrets securely while maintaining strong access control and rotation practices. Architecture overview: 1Password + Kubernetes. The 1Password integration with Kubernetes works by introducing an abstraction layer between Kubernetes and the 1Password cloud API. Instead of Kubernetes communicating directly with 1Password's cloud service, a 1Password Connect Server runs inside the cluster. This design provides better security, performance, and control. * Kubernetes communicates with the External Secrets Operator * ESO talks to the 1Password Connect Server inside the cluster * The Connect Server authenticates to 1Password using a token * Requested secrets are fetched and returned to Kubernetes This architecture allows secrets to be synced securely into Kubernetes-native Secret objects. Step 1: install External Secrets Operator and configure ClusterSecretStore. To begin, you must install the External Secrets Operator in your Kubernetes cluster. ESO provides the Custom Resource Definitions (CRDs) required to define how Kubernetes connects to external secret providers. The most important CRD in this setup is the ClusterSecretStore. It is a cluster-wide resource that defines how Kubernetes authenticates and communicates with 1Password. Example configuration: kubectl get ClusterSecretStore/ie-onepassword -o yaml apiVersion: external-secrets.io/v1 kind: ClusterSecretStore spec: conditions: - namespaceSelector: matchLabels: bango.com/dept: Engineering provider: onepassword: auth: secretRef: connectTokenSecretRef: key: token name: onepassword-connect-token-ie namespace: ns-dev-external-secrets connectHost: http://onepassword-connect.ns-dev-1password-connect-server.svc.cluster.local:8080 vaults: Engineering DevTest: 1 This configuration instructs ESO to communicate with the 1Password Connect Server rather than the public 1Password API. The Connect Pod authenticates using a token and retrieves secrets from the specified vault. Step 2: create externalsecret resources for applications. To consume secrets inside an application - for example, a service that uses a client certificate to authenticate to a remote endpoint - you must define an ExternalSecret resource. apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: labels: env: dev name: dev-cert-external-secrets-even namespace: ns-dev-engineering-korek spec: data: - remoteRef: key: CERT Engineering|endpoint|Cert|dev 20260626 property: endpoint_dev_CERT_PUBLIC.pem secretKey: CERT_PEM - remoteRef: key: CERT Engineering|endpoint|Key|dev 20260626 property: endpoint_dev_KEY.key secretKey: CERT_PRIVKEY target: name: dev-external-secrets-even creationPolicy: Owner deletionPolicy: Retain Key Concepts Explained * remoteRef.property specifies the exact entry inside 1Password to be retrieved. * Applications cannot reference ExternalSecret objects directly. * The target section defines the Kubernetes Secret that ESO creates and keeps in sync. This target secret is what applications ultimately consume. Supporting certificate rotation with even/odd secrets. To enable safe certificate and key rotation, it's recommended to maintain two ExternalSecrets: * dev-external-secrets-even * dev-external-secrets-odd This approach allows: * Seamless certificate rotation * Zero-downtime updates * Easy rollbacks by switching references When a rotation cycle is approaching, new certificates can be added to 1Password and synced to the inactive ExternalSecret without impacting the running application. Understanding creationPolicy and deletionPolicy. Two fields require special attention: creationPolicy: Owner * ESO creates the Kubernetes Secret if it doesn't exist * ESO updates the Secret whenever the external value changes * Deleting the ExternalSecret deletes the target Secret Alternatively, Merge can be used when multiple controllers manage the same Secret. deletionPolicy: Retain * If a secret is accidentally removed from 1Password, the Kubernetes Secret remains * Prevents accidental outages caused by human error * Recommended for production workloads Step 3: verifying externalsecret health. kubectl -n ns-dev-app get externalsecret NAME STORETYPE STORE REFRESH INTERVAL STATUS READY dev-app-external-secrets-even ClusterSecretStore ie-onepassword 5m SecretSynced True dev-app-external-secrets-odd ClusterSecretStore ie-onepassword 5m SecretSynced True Updating secrets in 1Password automatically updates the corresponding Kubernetes Secret without disrupting the application. Step 4: mount multiple secrets using projected volumes. To make both certificate sets available in the same directory inside a container, you can use a projected volume. This allows multiple secrets to be mounted into a single path. Example using Flux and Kustomize: patch: |- - op: add path: "/spec/template/spec/volumes/-" value: name: app-keystore-cert projected: sources: - secret: name: dev-app-external-secrets-odd items: - key: TEST_PEM path: app_keystore-odd.pem - key: TEST_PRIVKEY path: app_keystore-private-odd.pem - secret: name: dev-app-external-secrets-even items: - key: TEST_PEM path: app_keystore-even.pem - key: TEST_PRIVKEY path: app_keystore-private-even.pem The final step is simply configuring the application to reference the appropriate file inside the container. Final thoughts. Using 1Password with Kubernetes via the External Secrets Operator provides a secure, flexible, and production-ready approach to secret management. This setup enables: * Centralized secret storage * Safe certificate rotation * Reduced blast radius from human error * Kubernetes-native secret consumption For teams operating at scale, this approach significantly improves both security posture and operational reliability. Check out more of its blog posts here. Signal, not noise -. Join 12,000+ engineers and business leaders getting field notes on SRE, DevOps and cloud- native reliability. Your work email. More posts. Encryption is one of the first security controls FinTech companies think about when discussing PCI DSS. Sensitive data is encrypted at rest. Connections use TLS. Payment information is tokenized. Cloud... Expanding an iGaming business into a new regulated market is rarely as simple as obtaining a new license. Every jurisdiction comes with its own regulatory expectations, technical requirements, security controls,... Get In Touch ITGix provides you with expert consultancy and tailored DevOps services to accelerate your business growth.

Introducing universal sign-in: a seamless solution for every way you login. by Travis Hogan and Brandon Lucier September 2, 2026 - 4 min Today 1Password LLC is releasing universal sign-in, a new experience from 1Password that provides a seamless and secure way to sign into any site with your preferred method. It's currently available to all customers in the latest version of the 1Password browser extension. Signing in doesn't happen one way anymore. A single site might support passwords, passkeys, or third-party providers like Google. Over the last several years, 1Password has evolved to support all major authentication methods used today (passwords, passkeys, 2FA, social logins, OIDC and SAML). But the authentication experience varied because of differences with the underlying technologies. Not having a consistent way to use every authentication type 1Password offered meant needing to remember which third-party provider account you used, manually submitting pages, or needing to find and click sign-in fields. No password manager on the market had a single, consistent way to let you sign in, until now. Universal sign-in means that when you land on a login page, 1Password displays a single prompt to sign in using the authentication method you've chosen for that website. No need to remember how you've logged into the website in the past; passwords, passkeys, one-time codes, social logins, and company-managed apps will all appear in the same, intuitive prompt. Simply pick which account you'd like to sign in with, and 1Password handles the rest. How it works. * Visit a login page, or launch a saved login in 1Password with an available sign-in URL. * The universal sign-in prompt appears at the top of the login page using its new advanced field analysis. It'll appear when you need it, and disappear when you don't. * Every account and available authentication method is listed and selectable within the universal sign-in prompt. * Choose the login you'd like to use. Over time, 1Password also learns which accounts and methods you prefer using for that site. * 1Password then automatically fills your credentials across however many steps it takes to log into the site. It submits the forms, enters your one-time code, signs you in with your passkey, or selects the right provider for a social login or a managed app. * If a site requires you to manually complete a sign in step, an alert will display describing what the site needs you to do to complete sign in. 1Password already provided best-in-class autofill functionality. With universal sign-in, 1Password LLC is taking it a step further by improving the accuracy and speed of field analysis (i.e. what 1Password can and should autofill on a webpage) and sign-in with button detection (identifying buttons that allow third-party sign-in). This allows 1Password LLC to surface a consistent sign-in experience across many webpages, even when dynamic content changes. What once required multiple steps and clicks has been streamlined, reducing the time and effort it takes for you to sign in. Improving its field accuracy also improves both filling and autosubmit accuracy, making sure multi-page login flows are a seamless experience. Another crucial improvement involves how 1Password LLC handle URLs. The website address saved on a login is usually not the address that signs you in. It's often the homepage or the URL where you created the account in the first place. When you ask 1Password to open the site and fill in your details, it can leave you searching for the right way to login. To solve this problem, 1Password LLC developed enhanced sign-in URLs. Once every authentication method runs through its universal sign-in system, that system can be driven by something other than your click, including an AI agent acting with your explicit approval. That is the principle behind 1Password for Claude: your credentials stay in 1Password, access is scoped and approved, and the sign-in still happens. Universal sign-in is the layer underneath that makes it work the same way regardless of how a site expects you to authenticate. Universal sign-in is available in the latest 1Password browser extension, across Chrome, Edge, Firefox, Safari and other supported browsers. Already using 1Password? Update your browser extension and you are set. It works with the logins already in your vaults, so there is nothing to move or re-save. New to 1Password?

Advisory solutions reaches Certified Partner status with 1Password. Cybersecurity IT Security August 18, 2026 Advisory is proud to share that Advisory has been named a Certified Partner in 1Password's MSP Partner Program, a milestone reserved for MSPs managing more than 1,000 external users on the platform. 1Password recently introduced the Certified Tier to recognize partners who have moved past the early stages of deployment and fully operationalized the platform across their client base. Advisory reached that mark quickly, and 1Password featured its approach in a blog post this week, with insights from its Director of Business Development, Jay Chaudhrey, on how Advisory got there. Why Advisory went all in on 1Password. Before Advisory ever recommended 1Password to a client, Advisory used it ourselves. That's always been its approach to picking tools: the best way to know if something is worth recommending is to run it internally first and see how adoption actually goes. Once Advisory saw how well it worked, the rollout to clients wasn't really a hard sell. Password managers solve a problem that has a clear right answer. You either have one or you don't, and for most of its clients, not having one creates real exposure. A tool that scales with its client base. One of the reasons 1Password fits so well into how Advisory operate is that it works the same way whether Advisory is supporting a 5-person startup or a 1,000-person company. That consistency matters for an MSP with a lean team covering companies of very different sizes. Its process, its support model, and how Advisory implement the tool don't have to change based on who Advisory is serving. Where password management fits into the bigger picture. For most of its clients, the case for a password manager typically comes down to three things: security, compliance, and cyber insurance. Increasingly, it's difficult to pass a compliance audit without one, and insurers are paying closer attention to credential management as part of underwriting. That makes this a foundational piece of the security posture Advisory build for every client, not an optional add-on. Getting the operational details right. Scaling past 1,000 managed users doesn't happen by accident. Early on, Advisory focused on getting the fundamentals right for every client: how vaults are structured, who has access to what, and clear processes for onboarding and offboarding. Nailing down those SOPs early made adoption smoother and gave Advisory a repeatable model Advisory could roll out across every engagement. Advisory has also found 1Password to be a genuine partner, not just a vendor. When Advisory has run into adoption challenges with a client, their team has been quick to point Advisory toward the right resources. That level of support is part of what makes this partnership work. What Certified status means for its clients. Reaching the Certified Tier gives Advisory a deeper line into 1Password's roadmap, product feedback sessions, and expanded resources. In practice, that means its clients benefit from earlier visibility into new capabilities and a more direct channel when something needs attention. If you're evaluating password management as part of your security or compliance strategy, Advisory'd be glad to talk through what a rollout looks like for your team. Footer. 16 West 36th Street, Suite 501 New York, NY 10018 (212) 660-0007