Keeping Kubernetes Secrets
summary
Kubernetes Secrets are base64 not encrypted and live in etcd as readable data unless extra layers are added; kubeseal + SealedSecrets encrypts YAML for Git but its controller decrypts in-cluster, etcdctl can still reveal secrets if a node is compromised, and encryption-at-rest with a local key keeps the key on the master. The demo wires Quarkus + Vault + PostgreSQL using Kubernetes auth and Vault dynamic secrets to generate short‑lived DB passwords and rotate them, showing a working end‑to‑end replacement for relying solely on k8s secrets.
AI-written summary · about
chapters (11)
- 0:00Start
- 4:44The Architecture of Kubernetes
- 5:55Kubernetes Secrets
- 6:56Define a Secret
- 10:51Sealed Secrets
- 13:27Creating Sealed Secret
- 20:39Encryption Secrets at Rest
- 27:18Mounting the Secret as a File
- 32:50Dynamic Secrets
- 42:16Configure Vault
- 46:39Kubernetes Authentication
related talks
54mKeeping Kubernetes secrets secret
29mHow to Make Kubernetes Secrets Really… Secret?
46mSecuring Secrets in the GitOps era
43mSecuring Secrets in the GitOps Era
24mUnlocking the Secrets to Effective Secrets Management in GitOps
01h 02mSecret Management: The Soft Way
30mHow to Make Kubernetes Secrets Really… Secret?
54mBase64 is not encryption – a better story for Kubernetes Secrets