Download to read offline
Uploaded bySoluto
FTRD - Can Kubernetes Keep a Secret?
The document discusses various methods for managing secrets in Kubernetes, highlighting the importance of security and integration with GitOps. It contrasts several approaches including Kubernetes Secrets, HashiCorp Vault, and Kamus, outlining their features and limitations. Kamus is presented as a potential solution that meets the requirements of being GitOps-compatible, Kubernetes-native, and secure.
More Related Content
Similar to FTRD - Can Kubernetes Keep a Secret?
FTRD - Can Kubernetes Keep a Secret?
- 1. Can Kubernetes Keep aSecret? @omerlh
- 2.
- 3.
- 4.
- 6. @omerlh Super-Devs: Full Responsibility ●Writing Code ● Deploying to Production ● Monitoring https://www.imdb.com/title/tt4016454/mediaviewer/rm2380811776
- 7. @omerlh Super-Devs Need Help ●Good tools to support them ● Make it harder to do mistakes ● Secure by design
- 8.
- 9. @omerlh Manifests Files Code A GitOps Solution KubernetesIcons Source: Kubernetes Community, Apache 2 license
- 10. @omerlh How do wemanage secrets?
- 11. @omerlh Manifests Files Code Secret A GitOps Solution KubernetesIcons Source: Kubernetes Community, Apache 2 license
- 12. @omerlh Requirements GitOps Kubernetesnative Secure “One-way encryption”
- 13. @omerlh Pod is outof scope ● Who can “SSH” into it? ● What is running on the pod? ● Does the code leaked the secrets?
- 14.
- 15. @omerlh First iteration –Kubernetes Secrets
- 16.
- 17. @omerlh Requirements GitOps Kubernetesnative Secure
- 18.
- 19.
- 20.
- 21. @omerlh Well, that complicatesthings… http://i.imgur.com/5ebYy62.jpg @omerlh
- 22.
- 23. @omerlh Encrypted Secrets? ● Secretsthat can be committed ● Transparent for the application ● Multiple solutions ○ Helm Secrets ○ Sealed Secrets
- 24.
- 25.
- 26. @omerlh Issues ● Key Management ○Sealed Secret – single key-pair in the cluster ○ Helm Secret – based on Mozilla mops (AWS/GCP KMS support) ○ Coupled to a specific cluster/deployment method
- 27. @omerlh Requirements GitOps –under some serious limitations Kubernetes native Secure – depend on usage
- 28. @omerlh Second iteration –Hashicorp Vault
- 29. @omerlh What? ● Secure secretsstorage ● Native Kubernetes integration ● Seamless consuming ○ Side-car to generate config files https://www.vaultproject.io/
- 30.
- 31.
- 32.
- 33.
- 34.
- 35.
- 36. @omerlh Third iteration –Kamus Travis secret encryption – for Kubernetes https://kamus.soluto.io
- 37. @omerlh Manifests Files Code Secret A GitOps Solution KubernetesIcons Source: Kubernetes Community, Apache 2 license
- 38. @omerlh A Pod hasa Name Kubernetes Icons Source: Kubernetes Community, Apache 2 license
- 39. @omerlh Let’s Encrypt SomeSecrets!
- 40. @omerlh Manifests Files Code Secret Encrypted A GitOps Solution KubernetesIcons Source: Kubernetes Community, Apache 2 license
- 41.
- 42. @omerlh A perfect solution? GitOps Kubernetes native ? Secure
- 43. @omerlh Let’s talk aboutsecurity
- 44. @omerlh Permission Model Encrypt Decrypt UserYes (Can be limited) No Pod Yes Only it’s own secrets
- 45. @omerlh Kamus – ThreatModel Encryptor Decryptor Kubernetes Icons Source: Kubernetes Community, Apache 2 license
- 46. @omerlh Mitigations: User ● Secureby default permission model ● Secured CLI ○ Enforce HTTPS ○ Support for certificate pinning
- 47. @omerlh Mitigations: Git ● Strongencryption (using Cloud Provider KMS) ○ HSM protection ○ IP Filtering ● One-way encryption
- 48. @omerlh Mitigations: Pod ● Secureby default permission model ● In-Memory volume for decrypted files Kubernetes Icons Source: Kubernetes Community, Apache 2 license
- 49. @omerlh Mitigations: Kamus API ●Separate pods ● Authentication support for encryptor ● Security tests ○ SAST (Checkmarx) ○ DAST (OWASP Zaproxy) ○ Packages scan (Snyk)
- 50. @omerlh Kamus - Aperfect solution GitOps Kubernetes native Secure https://kamus.soluto.io/
- 51. @omerlh How can Iuse it? ● Simply using helm: helm install kamus soluto/kamus ● Checkout the install guide for a secure installation ● Blog post - https://bit.ly/2T2Nhgs
- 52. @omerlh Kamus Roadmap ● Rollingencryption keys ● Quality – improve test coverage ● Non-Kubernetes deployments ● SPIFFE support
- 53.
- 54. @omerlh Solutions GitOps Kubernetes Native Secure Kubernetes Secrets It dependsYes It depends Vault No Yes Yes Kamus Yes Yes Yes
- 55.
- 56.
- 57. @omerlh Can Kubernetes Keepa Secret? @omerlh
- 58. @omerlh Kamus Enable Super-Devsto Fly Higher https://www.imdb.com/title/tt4016454/mediaviewer/rm2380811776
- 59.
Editor's Notes
- #2 Hey, good morning everyone My name is Omer I want to start this talk by showing gratitude First, to all the people who worked hard on organizing this conf and all the people who are working today so we all could enjoy it - thank you Second, I want to thank the organizers who choose me to speak here, so thank you. It is a big honor <pause> Can kubernetes keep a secret? <pause> Why? Raise you’re hand if you ever worked on a project and you had to deal with credentials: API Key, client secret, certificates etc
- #3 What you need to do is pass these credentials securely to the platform running your code, so the app in production can use it. Different platforms have different solutions to the problem (sometime good, sometime bad). This talk will focus on Kubernetes – how we can tell a secret to Kubernetes, and make sure only Kubernetes will know it? But first – let me introduce myself quickly, so you could understand what are my credentials and where I’m coming from.
- #4 I’m a builder, this is what I love doing and doing it from a really early age Doing it professionally for the last 8 years I’m from Israel, married etc Who else is a builder? This talk is for you!
- #5 Today I’m working at Soluto, our missing is to help people with their technology My job is DevSecOps, or as I see it - helping the entire team to build a more secure software I’m achieving it via many approaches, including education, reviewing and threat modeling – but what I love the most is threat modeling
- #6 About me slides
- #7 What you need to do is pass these credentials securely to the platform running your code, so the app in production can use it. Different platforms have different solutions to the problem (sometime good, sometime bad). This talk will focus on Kubernetes – how we can tell a secret to Kubernetes, and make sure only Kubernetes will know it?
- #8 Explain why it is a challenge – you cant expect one person to manage all secrets Why not solved it manually
- #9 Explain why it is a challenge – you cant expect one person to manage all secrets Why not solved it manually
- #10 And that’s why we love GitOps: Git is a tool that all devs are familiar with.
- #12 And we started to look for solutions. It want not an easy path, and today I want to share with you the process we want through. So, let’s start we talking on what we want.
- #18 Choose one sentence
- #19 Security is what we all here love
- #23 Security features like encryption at rest
- #24 Encoding is not encrypting Adding native approach
- #27 Add meme
- #30 Security is what we all here love
- #45 Security is what we all here love
- #46 Battle tested
- #47 Add attributation
- #48 Add headlines – encryptor & decryptor
- #53 We really love Kamus, we’re been using it in production for the past 6 months
- #56 End of journey meme/image
- #57 Today I discussed 3 different solutions for secret management on Kubenretes. All are good solutions, depend on your requirments.
- #60 I started the talk by asking “Can Kubernetes keep a secret?” Now you that yes – Kubernetes can. You just need to use the right tool for you’re use case.
- #61 For us, it was Kamus What Kamus can do for you?