GCP to Tencent Cloud, secrets first

Platform case study, 2026. Role: Contributor · secrets & delivery.

Secrets, service discovery and GitOps foundations on Tencent Kubernetes Engine for a multi-cloud migration.

• 19 apps via GitOps
• KMS Vault auto-unseal
• GCS→COS data migrated
• VSO secrets synced to TKE

The problem

Moving workloads from GCP to Tencent Cloud meant rebuilding the foundations that applications quietly depend on: secrets, service discovery, delivery pipelines and object storage, without hand-copying credentials between clouds.

How it works

Secrets that unseal themselves

Vault on Tencent Cloud with KMS auto-unseal, alongside Consul, so restarts never need a human holding unseal keys.

Secrets into pods, not git

Vault Secrets Operator on TKE syncs secrets straight into Kubernetes, keeping credentials out of manifests.

Ship with GitOps

19 applications were deployed to TKE through GitOps, the same declarative flow the team already used on GKE.

Move the data

Object data migrated from Google Cloud Storage to Tencent COS.

Outcome

• Production-grade secrets management on Tencent Cloud from day one.
• 19 applications running on TKE through a repeatable GitOps flow.
• Data moved from GCS to COS as part of the migration.

Stack: Tencent TKE, HashiCorp Vault, Consul, Vault Secrets Operator, GitOps, COS.

Next case study: Cloud posture, on autopilot