Turtles All the Way Down: Managing Kubernetes Secrets
summary
Demo shows secrets in etcd as cleartext versus encrypted, proves application-layer encryption stops offline backup theft. Covers Kubernetes 1.7 secrets encryption, introduces 1.10 KMS plugin that uses envelope encryption (per-secret DEK + remote KEK), and a live Vault transit demo encrypting/decrypting with key versioning. Notes risks: KMS token on master can be stolen, recommend TPM/sealed keys or using external secret stores; rotate keys frequently (example: monthly key versions).
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:58Demo: Defending against offline attacks
- 6:42Why protect secrets?
- 7:10Secret management requirements Auditing
- 8:38Application Level Encryption
- 11:35Keys get old
- 14:20Version management
- 17:21Demo: Key Rotation in Vault
- 23:501.10 Envelope Encryption Sequence
- 26:53Demo: KMS Plugin for Vault
- 33:09Kubernetes secrets: HashiCorp Vault
- 34:27Kubernetes secrets: summary
related talks
54mKeeping Kubernetes secrets secret
54mKeeping Kubernetes Secrets
54mBase64 is not encryption – a better story for Kubernetes Secrets
29mHow to Make Kubernetes Secrets Really… Secret?
48mTurtles All the Way Down: Storing Secrets in the Cloud and the Data Center
46mSecuring Secrets in the GitOps era
30mHow to Make Kubernetes Secrets Really… Secret?
39mManaging and securing Kubernetes secrets - Simon Pearce