Secrets in Kubernetes - Cloud WAF

The universe is full of secrets and almost everything surrounding you  has tons of secrets just waiting to be discovered. In this article, we will be discussing one secret in particular which has been a boon to software developers, data-driven companies, and almost all the tech enthusiasts- Kubernetes Secrets.

Kubernetes Secrets allow the storage and management of sensitive information such as passwords, tokens, and ssh keys by the user. A secret is an object that contains small amounts of sensitive information mentioned above. The perks of Kubernetes secrets include more safety and flexibility as compared to other storage alternatives such as Pod or container image. Sensitive information in a secret can be accessed by pods via reference. Pods can be used with secrets in 3 ways such as files, container environment variable & kubelet.

The cherry on the top for these “secrets” is that Kubernetes provides a variety of basic protection layers which can be developed over time. The various groups of these protection layers are:

•  Kubernetes API
•  Pods
•  etcd
•  kubelet
•  Secret resources

These protection layers act as ‘bouncers at the club’ and help in separating Kubernetes secrets from Kubernetes resources, accessing them, and storing them securely.

The reality however is that even with all the perks & layers of protection mentioned above Kubernetes secrets are prone to a few risks. A few examples are:

• Secret data is stored in etcd and therefore is susceptible to a leak. This can be prevented by enabling encryption at cluster data for rest by admin, limiting access to admin users & using SSL/TLS for peer-to-peer communication (specific to a cluster running only).
• Base64 encoding is not an encryption method and therefore if a secret is configured through a manifest file with secret data encoded as base64, sharing it may lead to a leak of the secret data.
• The value of the secret is visible to the user/creator of the pod. By running a pod, they may be able to view the secret as well.
• Accidental logging and transmitting of the value of secrets via applications is a risk as well.

Now that this article has disclosed one secret of the universe, we hope you will put it to good use. Do not be discouraged by the risks, they can be mitigated by introducing tools to your operation stacks, and besides the pros of Kubernetes secret outweigh the cons. Kubernetes secrets are the future.