4 ms·
kubernetes "secrets" are base64 encoded only, anyone with access to the resource can view the original secret.
by jaxxstorm 9y ago
kubernetes "secrets" are base64 encoded only, anyone with access to the resource can view the original secret.
- jesseendahl 9y agoThe lack of encryption at rest for Kubernetes secrets was one of the (many) factors in why we originally chose Vault. That said, there's been a lot progress recently in this area recently. Starting in Kubernetes 1.7, you can optionally encrypt etcd at rest: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ https://kubernetes.io/docs/tasks/administer-cluster/encrypt-... You also have a few good choices for the crypto. Two of the choices are Secret Box (XSalsa20 + Poly1305) and AES-GCM with random nonce. Full list of providers, including info on strength + other considerations: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...