Kubernetes: how do I manage secrets safely?
poze 3 months ago68 gadeen
Kubernetes Secrets are just base64-encoded. I don't want DB passwords sitting in plain YAML in our git repo. What's the recommended approach?
Dyagnostik IA
Se IA ki fè l. Se pa yon repons — kominote a anba a konfime oswa korije l. Toujou verifye anvan ou fye l.
1 Repons
Correct, base64 is encoding, not encryption. Layered approach:
1. Never commit plain Secrets. Choose one of: - External Secrets Operator: syncs from AWS Secrets Manager, Azure Key Vault, GCP Secret Manager or Vault into K8s Secrets. Git only holds a reference. - Sealed Secrets or SOPS (with age/KMS): encrypted secrets that are *safe* to commit and decrypted in-cluster. 2. Enable encryption at rest for etcd (managed clusters usually do this; verify it). 3. RBAC: restrict get/list on Secrets. Many people with namespace access can otherwise read them all. 4. Prefer workload identity (IRSA on EKS, Workload Identity on GKE/AKS) so pods authenticate to cloud services without long-lived keys at all. 5. Mount secrets as files rather than env vars where possible, since env vars leak into crash dumps and debug output.
Konekte pou di lòt moun si li te mache.
Sign in and verify your email to post an answer.