It does help in that the secrets are not in plain-text, readable for any script you run. With 1Password, a process asks for the password and it gets transferred not through the filesystem but through IPC. 1Password shows a dialog: "Do you want iTerm to get your SSH key ABC123?"
In my thinking, this is more secure than plaintext in filesystem
If your system is compromised, it doesn't matter what you are using: the attacker will get the password for whatever secure thing you store your secrets in.
Maybe. Maybe not. It depends on the sophistication of the malware. Generally my impression is that these install-script type attacks cast a wide net. I would hazard a guess that they would not know how to even ask my 1Password for the keys. They are in an account they dont know, in a vault they dont know, and have a name they dont know
They don't need to ask 1Password for the keys, right? They can just take the kubectl auth once 1Password provided the key. But I would also bet any halfway competent script kiddy can vibecode credential stealing for the top 3 password managers these days. Heck, even open source red team stuff like this have it: https://github.com/efchatz/pandora
Not necessarily. defense in depth can help. At least forces an attacker to have to chain exploits, which although not impossible it makes it harder. Having root on a system doesn’t necessarily give you access to things that require touchid/yubikey/presence.
Sure, but is your system compromised because someone left a key in plaintext? Attack surface is finite and can be meaningfully reduced.