Extending Kubernetes with Storage Transformers
summary
Storage transformers run inside kube-apiserver just before objects hit etcd and let code mutate the raw bytes so secrets are encrypted before being written. The demo shows a working transformer, use of envelope encryption (per-secret DEKs wrapped by CSA/KMS KEKs) to enable online rotation without API restarts, and a local KMS plugin over a Unix socket that proxies to cloud KMS. The implementation uses prefix transformers to avoid conflicts and recommends sealing KMS credentials in TPMs; the demos succeed end to end.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:02Extensibility at the RPC layer
- 2:42Motivating Problem - Encrypting Secrets at Rest
- 7:26Implement Transformer Interface
- 8:09Step #2: Create your YAML config structure
- 9:20Add your type to ProviderConfiguration
- 9:39Prefix Transformer
- 10:30Define your prefix
- 10:43Add Init logic for your transformer
- 16:41Re-using Envelope Transformer
- 18:24KMS encryption configuration
- 19:52add configurable DEK type to KMS plugin
- 20:21teach KMS plugin about your new DEK type
- 20:35choose your KMS provider and plugin
- 24:20Summary
related talks
29mExtending Kubernetes with Storage Transformers
35mTurtles All the Way Down: Managing Kubernetes Secrets
54mKeeping Kubernetes secrets secret
54mBase64 is not encryption – a better story for Kubernetes Secrets
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
24mCan You Keep a Secret? On Secret Management in Kubernetes
29mBase64 is not encryption...
16mA Kubernetes Zero Trust Security Model Using a KMS Provider Plugin