Base64 is not encryption...
summary
Kubernetes secrets are base64 encoded and written to etcd in plaintext so anyone with etcd access reads credentials; the remedy shown is envelope encryption with per-secret data keys and a separate key-encryption key managed by a KMS. Examples: Kubernetes 1.7 adds encryption config, 1.10 adds a KMS encryption provider via UNIX socket that delegates to cloud KMS or HashiCorp Vault transit, demoed working on a kubeadm cluster; GKE offers flags to enable it.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:33What's a secret?
- 1:49Secret (noun) Credentials, configurations, API keys, or other pieces of information needed by an application at build time or run time
- 2:19Why protect secrets?
- 4:55Protecting secrets
- 7:51App-layer encryption
- 9:22Kubernetes defaults
- 9:40Insecure by default
- 18:15Kubernetes 1.7 Envelope encryption
- 27:29Demo
related talks
54mBase64 is not encryption – a better story for Kubernetes Secrets
54mKeeping Kubernetes secrets secret
14mAre Your Secrets Encrypted at Rest and in Transit? (Q5)
29mHow to Make Kubernetes Secrets Really… Secret?
54mKeeping Kubernetes Secrets
24mUnlocking the Secrets to Effective Secrets Management in GitOps
46mSecuring Secrets in the GitOps era
43mSecuring Secrets in the GitOps Era