Hardware-based KMS Plug-in to Protect Secrets in Kubernetes
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 6E - San Diego Convention Center, Upper Level·
summary
Proposal to extend the Kubernetes KMS plugin so encryption and decryption run inside a CPU-protected Trusted Execution Environment (example: Intel SGX), allowing KEK cached in SGX enclave so API servers never hold KEKs/DEKs in clear memory and most ops avoid round trips to remote KMS, improving latency. Reference uses a modified Vault KMS plugin with C/C++ SGX libs, shows three demos (baseline, enclave-cached DEK, fully-provisioned KEK), and notes enclave attestation required, enclave size limits and a KEP plus reference code as next steps.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:55Secrets in Kubernetes
- 5:28KMS Encryption Provider
- 7:18KMS Plugin
- 9:20Key Observations
- 11:47What is a Trusted Execution Environment
- 13:58How does it work
- 16:30Demos
- 21:40Demo Environment
- 24:37Demonstration
- 31:54Wrapup
related talks
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure
23mKubernetes + Encrypted Memory = Security * Privacy
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
25mAgentic Zero Trust: at Rest, in Transit, and at Runtime
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!- 40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
33mKey Per IO Security Subsystem Class for NVM Express Storage Devices