How to Make Kubernetes Secrets Really… Secret?
summary
Kubernetes stores Secrets as Base64, so sensitive values can be plaintext in pods and at runtime; etcd and API traffic therefore need TLS and at‑rest encryption. Use Vault or cloud secret managers plus a secret-store CSI driver or ExternalSecrets controller to sync secrets into volumes, apply RBAC, auditing and rotation, and generate secrets with Terraform so credentials are never handled by humans; the CSI/ExternalSecrets solutions also detect version changes and update pods.
AI-written summary · about
chapters (6)
- 0:00Kubernetes security introduction
- 2:52Kubernetes security fundamentals
- 8:35Existing secret resources
- 10:39Improving secret security
- 17:22Additional best practices
- 21:35Conclusion and suitable choices
related talks
30mHow to Make Kubernetes Secrets Really… Secret?
54mKeeping Kubernetes secrets secret
54mKeeping Kubernetes Secrets
46mSecuring Secrets in the GitOps era
43mSecuring Secrets in the GitOps Era
29mBase64 is not encryption...
24mUnlocking the Secrets to Effective Secrets Management in GitOps
14mAre Your Secrets Encrypted at Rest and in Transit? (Q5)