# GCP to Tencent Cloud, secrets first

Platform case study, 2026. Role: Contributor · secrets & delivery.

Secrets, service discovery and GitOps foundations on Tencent Kubernetes Engine for a multi-cloud migration.

- 19 apps via GitOps
- KMS Vault auto-unseal
- GCS→COS data migrated
- VSO secrets synced to TKE

## The problem

Moving workloads from GCP to Tencent Cloud meant rebuilding the foundations that applications quietly depend on: secrets, service discovery, delivery pipelines and object storage, without hand-copying credentials between clouds.

## How it works

### Secrets that unseal themselves

Vault on Tencent Cloud with KMS auto-unseal, alongside Consul, so restarts never need a human holding unseal keys.

### Secrets into pods, not git

Vault Secrets Operator on TKE syncs secrets straight into Kubernetes, keeping credentials out of manifests.

### Ship with GitOps

19 applications were deployed to TKE through GitOps, the same declarative flow the team already used on GKE.

### Move the data

Object data migrated from Google Cloud Storage to Tencent COS.

## Outcome

- Production-grade secrets management on Tencent Cloud from day one.
- 19 applications running on TKE through a repeatable GitOps flow.
- Data moved from GCS to COS as part of the migration.

Stack: Tencent TKE, HashiCorp Vault, Consul, Vault Secrets Operator, GitOps, COS.

Next case study: [Cloud posture, on autopilot](https://kirat.space/work/cloud-posture)

---

Kirat Pal Singh Lamba, Lead DevOps Engineer, Bengaluru, India.

- [kirat.lamba10@gmail.com](mailto:kirat.lamba10@gmail.com)
- [LinkedIn](https://www.linkedin.com/in/kirat-pal-singh-lamba-00893b147/)
- [GitHub](https://github.com/skirat)
- [Medium](https://medium.com/@skirat)