3 ms·
K8s supports encryption at rest, ACLs and audit logs. What it actually lacks is versioning, and a dynamic secrets engine, though you could build that with an o
by ownagefool 3y ago
K8s supports encryption at rest, ACLs and audit logs.
What it actually lacks is versioning, and a dynamic secrets engine, though you could build that with an operator, and things like the postgres-operator do.
You also don't get the whole sealing thing, but I'd argue that's more annoying than useful.
- sleepybrett 3y ago> You also don't get the whole sealing thing, but I'd argue that's more annoying than useful. A-fucking-men.
- vosper 3y agoWhat's "sealing" in this context?
- proxysna 3y agoUnsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data, allowing access to the Vault. Prior to unsealing, almost no operations are possible with Vault. For example authentication, managing the mount tables, etc. are all not possible. The only possible operations are to unseal the Vault and check the status of the seal. https://developer.hashicorp.com/vault/docs/concepts/seal https://developer.hashicorp.com/vault/docs/concepts/seal