MOmorelisp·Mar 4, 2022
No, storing encrypted secrets in repositories is an incredibly common and safe practice in DevOps/GitOps environments. Virtually every orchestration tool has some way to support it.
E.g. k8s sealed secrets https://github.com/bitnami-labs/sealed-secrets
E.g. Salt's GPG filters https://docs.saltproject.io/en/latest/ref/renderers/all/salt...
E.g. Ansible Vault https://docs.ansible.com/ansible/latest/user_guide/vault.htm...
E.g. Puppet hiera-yaml https://puppet.com/docs/puppet/6/securing-sensitive-data.htm...
PD/PII is a completely separate issue. First because even encrypting doesn't remove legal obligations concerning processing, and second because your DS/BI teams probably need access to the unencrypted data to like, do their actual jobs. You need completely orthogonal forms of access control for that (like SSO as you alude to).
In A GitHub repository was public-viewable