4 ms·

Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this. If

Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this. If I control a physical cluster of machines end-to-end, I might consider Kubernetes (because I don't have any better options and doing the work to actually secure it is probably less work than my alternatives), but it's also one of the reasons--though far from the only reason--that I couldn't begin to consider k8s if I'm running in AWS or another cloud environment.

erickt 9y ago
> Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this. They are in progress towards encrypting at rest the etcd database. You can experimentally turn it on by following this doc: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...
SEJeff 9y ago
Kubernetes 1.7 added the concept of a Provider to encrypt secrets to/from etcd3: https://docs.google.com/document/d/1lFhPLlvkCo3XFC2xFDPSn0jAGpqKcCCZaNsBAv8zFdE/edit# https://docs.google.com/document/d/1lFhPLlvkCo3XFC2xFDPSn0jA... https://github.com/kubernetes/kubernetes/pull/41939 https://github.com/kubernetes/kubernetes/pull/41939 https://github.com/kubernetes/kubernetes/pull/49350 https://github.com/kubernetes/kubernetes/pull/49350 etc. There is an implementation to use Hashicorp's Vault to encrypt secrets (using this functionality) which looks quite nice actually: https://docs.google.com/document/d/15-baW4i7qws1yxxIYjHXqKpk259ebauQbECQCpPD308/edit# https://docs.google.com/document/d/15-baW4i7qws1yxxIYjHXqKpk...