Moritz Johner is a staff engineer at Form3 and a creator and maintainer of External Secrets Operator, an open-source Kubernetes project that integrates external credential-management systems. He builds infrastructure that makes secrets management and AI-assisted software maintenance useful without granting automated systems excessive authority.
From Kubernetes secrets to secure automation
Johner studied media technology and worked across web agencies, startups, and consulting before specializing in cloud infrastructure. A consulting assignment in 2018 required Kubernetes to operate across multiple AWS accounts, prompting him to improve cross-account role support in existing open-source tools. He subsequently proposed a shared specification for external secrets, helping consolidate fragmented approaches to Kubernetes credential management.
The resulting External Secrets Operator connects Kubernetes with providers including AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, and Azure Key Vault. At Form3, Johner applied related ideas to cloud-agnostic Kubernetes infrastructure for payments teams. He has also worked as a Linux Foundation Kubernetes trainer and advised the commercial External Secrets company, which wound down in December 2025. His independent projects include harbor-sync, which synchronizes Harbor robot-account credentials with Kubernetes, and udplb, an eBPF-based UDP packet forwarder.
Security principles behind his work
Coding agents are software supply-chain actors. Johner and colleagues developed PatchPilot to remediate vulnerabilities across thousands of repositories. Unlike manifest-oriented dependency bots, it can address flaws in container base images or downloaded binaries and coordinate related runtime, linter, and CI changes. Johner treats production-bound code changes as supply-chain activity requiring explicit safeguards.
Deterministic orchestration, constrained agentic reasoning. PatchPilot’s Go controller scans container images, identifies affected repositories, handles Git operations, opens pull requests, and monitors CI. Agents investigate vulnerabilities and repair failures but can only modify files: they cannot push commits, trigger workflows, or create pull requests independently. Changes remain narrowly scoped, retries are limited, and human approval is required before merging.
Prompt-injection resilience through limited blast radius. Repository contents, dependencies, and CI logs can contain malicious instructions. Johner tests adversarial repositories and marks untrusted inputs, but emphasizes architectural containment: compromised agents cannot exercise credentials they never receive.
Firecracker microVM isolation for agent workloads. Giving an agent access to a host Docker socket can defeat ordinary container isolation. Johner’s evolving design places the agent and its Docker daemon inside a Firecracker microVM, establishing a separate kernel boundary and distinct outbound-network policies for agentic and deterministic components. His PatchPilot security case study treats sandboxing as one layer within a broader system of restricted permissions, inspectable orchestration, and human review.
