Are Your Secrets Encrypted at Rest and in Transit? (Q5)

on YouTube ↗14m

" summary

Kubernetes secrets are only base64-encoded by default so base64 is not encryption and anyone with RBAC or host root can decode them. The etcd datastore stores secret values in plain text unless the API server uses an encryption-config.yaml to enable envelope encryption, shown by gibberish bytes in the etcd file after enabling it. The encryption key lives in the API server config so a compromised host with access to that file still exposes secrets; mitigation options include isolating etcd and using an external vault like HashiCorp Vault and strict RBAC and container escape hardening.

AI-written summary · about

" chapters (3)

1. 0:00Intro
2. 1:53Are your secrets encrypted at rest and in transit?
3. 4:07Demo

" related talks

• 29mBase64 is not encryption...Seth Vargo · DevOpsDays Philadelphia 2019
• 29mHow to Make Kubernetes Secrets Really… Secret?Julie HOURCADE · Devoxx France 2023
• 54mBase64 is not encryption – a better story for Kubernetes SecretsSeth Vargo · Riga Dev Days 2019
• 54mKeeping Kubernetes SecretsAlex Soto · Devnexus 2022
• 54mKeeping Kubernetes secrets secretAlex Soto · Conf42 DevSecOps 2023
• 24mUnlocking the Secrets to Effective Secrets Management in GitOpsKunal Verma · GitOpsCon Europe 2023
• 46mSecuring Secrets in the GitOps eraAlex Soto · DevOps Barcelona Conference 2023
• 43mA Confidential Story of Well-Kept SecretsLukonde Mwila · KCD Los Angeles 2023