4 ms·

Besides what others have pointed out about the base64 comment which is very unfortunate coming from RedHat... this is a very superficial article which doesn’t r

by outime 5y ago

Besides what others have pointed out about the base64 comment which is very unfortunate coming from RedHat... this is a very superficial article which doesn’t really explain how to actually store secrets safely. I found happiness by either using AWS KMS (I assume other clouds offerings can do the same) by then storing the encrypted blob in K8s Secrets or through the Vault sidecar approach (obviously when using Vault only).

topspin 5y ago
> which is very unfortunate coming from RedHat... It's sad but undeniable anecdote, most easily explained by ignorance; Red Hat is just an IBM brand serviced by low skill/cost IT drones now. The fact that Kubernetes uses base64 for storing secrets by default is another head shaker. One would think self respect would preclude this sort of thing.
- margor 5y ago
  It is not a default by any means, you can write it down to yaml as plain text too without any processing[0]. Just for some reason people decided to always use base64 without any actual reason behind it. Edit: There is reason to do it explained above[1] - to store binary data in the yaml, but doesn't change fact you don't have to use it. [0] https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret https://kubernetes.io/docs/concepts/configuration/secret/#ba... [1] https://news.ycombinator.com/item?id=27731430 https://news.ycombinator.com/item?id=27731430
  - topspin 5y ago
    > It is not a default by any means Yes it is. Caution: Kubernetes Secrets are, by default, stored as unencrypted base64-encoded strings. https://kubernetes.io/docs/concepts/configuration/secret/ https://kubernetes.io/docs/concepts/configuration/secret/
    - margor 5y ago
      I'm sorry, I thought it was about storing it in yaml and not the underlying storage method.
- op00to 5y ago
  > Red Hat is just an IBM brand serviced by low skill/cost IT drones now Citation requested.

by outime 5y ago

topspin 5y ago

> which is very unfortunate coming from RedHat... It's sad but undeniable anecdote, most easily explained by ignorance; Red Hat is just an IBM brand serviced by low skill/cost IT drones now. The fact that Kubernetes uses base64 for storing secrets by default is another head shaker. One would think self respect would preclude this sort of thing.

margor 5y ago
It is not a default by any means, you can write it down to yaml as plain text too without any processing[0]. Just for some reason people decided to always use base64 without any actual reason behind it. Edit: There is reason to do it explained above[1] - to store binary data in the yaml, but doesn't change fact you don't have to use it. [0] https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret https://kubernetes.io/docs/concepts/configuration/secret/#ba... [1] https://news.ycombinator.com/item?id=27731430 https://news.ycombinator.com/item?id=27731430
- topspin 5y ago
  > It is not a default by any means Yes it is. Caution: Kubernetes Secrets are, by default, stored as unencrypted base64-encoded strings. https://kubernetes.io/docs/concepts/configuration/secret/ https://kubernetes.io/docs/concepts/configuration/secret/
  - margor 5y ago
    I'm sorry, I thought it was about storing it in yaml and not the underlying storage method.
op00to 5y ago
> Red Hat is just an IBM brand serviced by low skill/cost IT drones now Citation requested.