Ivan Pedrezas talking about Kubernetes and Vault

1. Kubernetes and Vault
@ipedrazas

2. Sense
and
Sensibility

5. Secret vs Sensitive

6. it’s not about security,
it’s about perception.

12. What is Kubernetes
Kubernetes is an open-source system for
automating deployment, operations, and
scaling of containerized applications.

13. Kubernetes automates
deployment,
operations,
and scaling of applications.

14. Pods
Replica Sets
Services
Secrets
Namespaces
Deployments
DaemonSets
Jobs
...

15. Pods: Groups of containers - Share IP and FS
Replica Sets: Controls Number of pods
Services: Access to Pods

17. Why Vault?
● How do Applications get Secrets?
● How do Operators and Developers get Secrets?
● How do secrets get Renewed? Updated? Expired? Revoked?
● How do we block access to secrets?

19. Vault provides
● Single Source for Secrets
● Access via API
● Access via cli
● Leasing, renewal and revocation
● Auditing
● ACLs
● Multiple client authentication methods
● Secure Secret Storage

20. Vault Concepts
● Auth Backends
○ Tokens
○ Ldap
○ AppId
○ Github
● Secret Backends
○ PKI
○ AWS
○ Postgres
○ ssh
○ ...

21. ...

22. But… wait!

23. Kubernetes has
SECRETS!

27. WHY DO YOU NEED BOTH?????

28. It’s about people!

29. Ivan
I like to make things
design
make
build
fix
@ipedrazas
DevOps @ Sendachi / Contino

30. What are we going to see tonight?

32. Thing is…
when building something...

33. Quality
is not only how good it is,
it’s how usable it is

34. Secrets

35. The problem is not
how to separate
Applications & Secrets

36. The problem is how to manage them...
SEPARATELY

37. Storing
Managing
Renewing
Secrets...
Process, anyone?

38. The process says CLEARLY…
DO NOT COMMIT SECRETS

39. Next slide contains the secret demo

40. MongoDB Example
● RC with 2 containers
○ MongoDB container: vanilla mongo with AUTH and SSL flags
○ Vault-sidekick container: in charge of fetching/renewing SSL certs

41. 1. A container runs your application
2. A container fetches your secrets from Vault.
Application - POD

44. This is what you should do
1. Create a policy for your app
2. Create a Kubernetes namespace for your app
3. Create a Kubernetes secret with your Vault token
4. Add your secrets to Vault
5. Pod starts
a. Secrets are mounted
b. Pod reads vault token
c. Pod access vault to get secrets
d. Pod is ready
THEORY

46. We can only see a short distance ahead, but we
can see plenty that needs to be done.
- Alan Turing

47. Lessons Learned
● Vault is young… not ready for fully automation
● Deploys
○ Separating secrets and apps is great
○ Make sure your process contemplates Vault
● Backends: consul, dynamo, etcd, s3...
○ what happens if you lose Vault?
○ latency/partitions
● Managing SSL is great but…
○ Be Careful with Root CAs

49. QUESTIONS?