Securing Secrets in K8s Environments
summary
Claims that a Secrets manager alone is insufficient and shows a live HashiCorp Vault attack demo where an attacker reads /proc/<pid>/environ and encrypts the Vault volume to cause downtime. Presents a concrete defense: deploy CubeArmor policies that convert rules to BPF LSM/AppArmor controls and enforce inline mitigation at LSM hooks so only listed binaries can read specific volume paths or env files. Shows this blocks injected executables, protects Kubernetes Secrets and PVs, and applies equally to databases like MySQL.
AI-written summary · about
chapters (7)
- 0:00Introduction to secret security
- 2:01Threat models for secret storage
- 6:34Application secret consumption
- 11:20Inline mitigation with KubeArmor
- 16:54Hardening with security policies
- 20:57Conclusion and best practices
- 22:32Q&A session
related talks
25mCan you keep a secret?
39mManaging and securing Kubernetes secrets - Simon Pearce
30mHow to Make Kubernetes Secrets Really… Secret?
49mManaging Secrets in a Kubernetes Cluster with Hashicorp Vault
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
41mEasy Secrets in Kubernetes: Because I Vault It Well
34mWhich Vault? Don't tell me your secret(s)!
29mBehind Closed Doors: Managing Passwords in a Dangerous World