Keeping Kubernetes secrets secret
summary
Kubernetes Secret is just Base64 not encryption and the demo shows creating a Secret, converting it to a sealed-secrets manifest that uses a controller public key to encrypt data, and applying it so the controller decrypts into a native Secret. External Secrets is shown pulling values from HashiCorp Vault and materializing Kubernetes Secrets without storing values in git. Etcd encryption without a KMS leaves keys in etcd, so the recommendation is a KMS plugin and using dynamic secrets with rotation and direct Vault consumption into pod memory.
AI-written summary · about
chapters (23)
- 0:00intro
- 1:43preamble
- 2:29about alex
- 2:51what is a secret
- 3:36it's about layers
- 5:14what is devops and gitops?
- 7:51what is gitops?
- 10:23gitops application delivery model
- 16:05protecting secrets stored in git
- 16:48sealerd secrets
- 20:27external secrets
- 24:00demo
- 32:54encryption data at rest
- 34:37encrypt etcd data
- 36:16possible solutions
- 38:25how we indect etcd secrets into deployments
- 41:02hashicorp vault
- 42:28the good, the bad and the ugly
- 45:34demo
- 50:46secrets lifecycle
- 51:23conclusions
- 53:20thank you
- 53:38resources
related talks
54mKeeping Kubernetes Secrets
29mHow to Make Kubernetes Secrets Really… Secret?
54mBase64 is not encryption – a better story for Kubernetes Secrets
46mSecuring Secrets in the GitOps era
29mBase64 is not encryption...
24mUnlocking the Secrets to Effective Secrets Management in GitOps
30mHow to Make Kubernetes Secrets Really… Secret?
01h 02mSecret Management: The Soft Way