Base64 is not encryption – a better story for Kubernetes Secrets
summary
Kubernetes stores Secrets as base64 in etcd by default so anyone with etcd access or backups sees plaintext; the talk demonstrates this on minikube and then implements envelope encryption (Kubernetes 1.7) and KMS plugins (1.10) to move key material out of the master. Demos use HashiCorp Vault transit as a KMS, show encrypted blobs in etcd, note 200–300 ms latency for remote KMS calls, and advocate envelope encryption plus regular key rotation and auditing.
AI-written summary · about
chapters (11)
- 0:00Introduction to Kubernetes Secrets
- 13:03Kubernetes defaults are insecure
- 16:33Live demo of insecure secrets
- 19:21What is envelope encryption
- 23:13Kubernetes 1.7 envelope encryption
- 28:39Limitations of Kubernetes 1.7
- 29:02Kubernetes 1.10 KMS integration
- 36:51On-premises KMS with Vault
- 38:14Live demo with Vault encryption
- 43:52Summary and best practices
- 47:03Q&A session
related talks
29mBase64 is not encryption...
54mKeeping Kubernetes secrets secret
14mAre Your Secrets Encrypted at Rest and in Transit? (Q5)
54mKeeping Kubernetes Secrets
29mHow to Make Kubernetes Secrets Really… Secret?
24mUnlocking the Secrets to Effective Secrets Management in GitOps
46mSecuring Secrets in the GitOps era
35mTurtles All the Way Down: Managing Kubernetes Secrets