Deep dive into Kubernetes secrets
Delve into the world of Kubernetes secrets management, uncovering myths and truths about securing sensitive information. Learn about storing secrets, encryption practices, and the importance of proper configuration for RBAC. Discover the Swiss Army knife for HashiCorp Vault on Kubernetes and explore techniques for injecting and retrieving secrets. Enhance your knowledge of safeguarding confidential data in Kubernetes environments.
Uploaded on Feb 20, 2025 | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Deep dive into Kubernetes Kubernetes secrets S gi-Kaz r M rk @sagikazarmark
Myth: Kubernetes secrets aren t secure
Kubernetes secrets Store sensitive information Inject into containers as files as environment variables
base64 is encoding encryption encoding, not
Encryption at rest Encryption config: encrypt secrets before storing in etcd Plaintext by default!
Myth: Kubernetes secrets arent secure Secrets are stored in plaintext by default (encryption is optional) No control over managed services (trust, compliance) RBAC needs to be configured properly
Swiss-army knife for Hashicorp Vault on Kubernetes Secrets are stored safely in Vault Secret values are injected directly into pods https://github.com/banzaicloud/bank-vaults
Other solutions kube-secrets-init: Mutating webhook for AWS/GCP secret stores (inspired by Bank-Vaults) external-secrets: synchronize Kubernetes secrets from external secret stores Kamus: combination of Bank-Vaults and external-secrets using KMS instead of a secret store
Thank Thank you you! ! S gi-Kaz r M rk @sagikazarmark
