Extending Kubernetes with Storage Transformers
summary
Kube-apiserver invokes storage transformers just before reads/writes to etcd so custom logic can mutate the raw protobuf blobs; encryption transformers replace plaintext secrets with a prefix plus ciphertext, and envelope encryption uses a per-object DEK encrypted by a remotely held KEK so keys never land in clear on the master. The system supports KMS plug-ins over a UNIX domain socket for automated key rotation without API restarts, prefix-based versioning, and protects plugin credentials via TPM sealing; an SM4-based transformer is shown as an example.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:02Extensibility at the RPC layer
- 2:42Motivating Problem - Encrypting Secrets at Rest
- 7:26Implement Transformer Interface
- 8:09Step #2: Create your YAML config structure
- 9:20Add your type to ProviderConfiguration
- 9:39Prefix Transformer
- 10:30Define your prefix
- 10:43Add Init logic for your transformer
- 16:41Re-using Envelope Transformer
- 18:24KMS encryption configuration
- 19:52add configurable DEK type to KMS plugin
- 20:21teach KMS plugin about your new DEK type
- 20:35choose your KMS provider and plugin
- 24:20Summary
related talks
29mExtending Kubernetes with Storage Transformers
54mBase64 is not encryption – a better story for Kubernetes Secrets
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
35mTurtles All the Way Down: Managing Kubernetes Secrets
29mBase64 is not encryption...
16mA Kubernetes Zero Trust Security Model Using a KMS Provider Plugin
54mKeeping Kubernetes secrets secret
35mExtending Kubernetes: Our Journey & Roadmap