https://DevOpsCloud.io -- Cloud Monk Losang Jinpa

Return to Kubernetes Secrets Management by Alex Soto Bueno and Andrew Block, Kubernetes Secrets Management

Fair Use Source: B0BPTHW6P4 (K8SScrtMg 2023)

“ (K8SScrtMg 2023)

contents

preface

xi

acknowledgments

xiii

about this book

xv

about the authors

xviii

about the cover illustration

xix

PART 1

SECRETS AND KUBERNETES ………………………… 1

1 Kubernetes Secrets 3

1.1

A focus on security

4

1.2

Taking full advantage of the Kubernetes ecosystem

5

1.3

Not everything is a Secret

5

1.4

Bringing secrets management and Kubernetes

together

6

1.5

Tools to get started

9

2 An introduction to Kubernetes and Secrets 10

2.1

Kubernetes architecture

11

What is a master Node?

12 ■ What is a worker Node?

13

2.2

Deploying workloads in Kubernetes

13

Deploying a workload

13 ■ Deployment objects

15

Volume

19

vii

viii

CONTENTS

2.3

Managing application configuration

19

ConfigMaps

19

2.4

Using Kubernetes Secrets to store sensitive information

25

Secrets are encoded in Base64

26 ■ Secrets are mounted in a

temporary file system

28 ■ Secrets can be encrypted at rest

28

Risks

29

PART 2

MANAGING SECRETS ……………………………….. 33

3 Securely storing Secrets 35

3.1

Storing Kubernetes manifests at rest

36

Capturing resources for declarative configuration

37

3.2

Tools for securely storing Kubernetes resources

40

Ansible Vault

40

3.3

Kubernetes Operators

45

Custom resource definitions (CRDs)

46

Sealed Secrets

47

3.4

Managing Secrets within Kubernetes package managers

51

Deploying the Greeting Demo Helm chart

52 ■ Using Helm

Secrets

54

3.5

Rotating secrets

58

Ansible Vault secret key rotation

58 ■ Sealed Secrets key

rotation

59 ■ SOPS secret key rotation

60

4 Encrypting data at rest 61

4.1

Encrypting secrets in Kubernetes

62

Data at rest vs. data in motion

62 ■ Plain secrets

62

Encrypting secrets

64 ■ Creating the secret

67

4.2

Key management server

69

Kubernetes and KMS provider

70 ■ Creating the secret

77

5 HashiCorp Vault and Kubernetes 79

5.1

Managing application secrets using HashiCorp

Vault

80

Deploying Vault to Kubernetes

81 ■ Deploying an application

to access Vault

91

CONTENTS

ix

5.2

Kubernetes auth method

94

Configuring Kubernetes auth

95 ■ Testing and validating

Kubernetes auth

97

5.3

The Vault Agent Injector

98

Configurations to support Kubernetes Vault Agent injection

100

6 Accessing cloud secrets stores 103

6.1

The Container Storage Interface and Secrets Store CSI

Driver

104

Container Storage Interface

104 ■ Container Storage Interface

and Kubernetes

106 ■ CSI and secrets

107 ■ Installing

prerequisites

108 ■ Installing the Secrets Store CSI Driver

109

Consuming HashiCorp Vault secrets via the Secrets Store CSI Driver

and the HashiCorp Vault provider

111

6.2

Synchronizing CSI secrets as Kubernetes Secrets

116

Preparing the namespace

117 ■ Defining a SecretProviderClass

resource with secretObjects

117

6.3

Autorotating secrets to improve security posture

121

Preparing the namespace

122 ■ Deploying the Pod with a secret

mounted

125 ■ Updating the secret

126

6.4

Consuming secrets from cloud secrets stores

126

Azure Key Vault

127 ■ GCP Secret Manager

135

AWS Secrets Manager

143

PART 3

CONTINUOUS INTEGRATION AND

CONTINUOUS DELIVERY …………………………. 149

7 Kubernetes-native continuous integration and Secrets 151

7.1

Introduction to continuous integration

152

7.2

Tekton

153

Installing prerequisites

154 ■ Installing Tekton

156

Tekton pipelines

157

7.3

Continuous integration for a welcome message

163

Compiling and Running tests

166 ■ Building and Pushing the container image

166 ■ The PipelineResource

168

Pipeline

169 ■ PipelineRun

170

8 Kubernetes-native continuous delivery and Secrets 174

8.1

Introduction to continuous delivery and continuous deployment

175

x

CONTENTS

8.2

Continuous delivery for the welcome message

176

Deploying the Name Generator service

176 ■ DevOps and

GitOps

178

8.3

Argo CD

179

Installation of ArgoCD

180 ■ Welcome service and GitOps

182

Creating a Welcome Message service from a Git repository

186

Updating the Welcome service

190

appendix A

Tooling

201

appendix B

Installing and configuring yq

207

appendix C

Installing and configuring pip

210

appendix D

Installing and configuring Git

213

appendix E

Installing GPG

216

index

219

---

---

Document Outline

Kubernetes Secrets Management

brief contents

contents

preface

acknowledgments

about this book Who should read this book?

How this book is organized: A roadmap

About the code

liveBook discussion forum

about the authors

about the cover illustration

Part 1 Secrets and Kubernetes 1 Kubernetes Secrets 1.1 A focus on security

1.2 Taking full advantage of the Kubernetes ecosystem

1.3 Not everything is a Secret

1.4 Bringing secrets management and Kubernetes together

1.5 Tools to get started

Summary

2 An introduction to Kubernetes and Secrets 2.1 Kubernetes architecture 2.1.1 What is a master Node?

2.1.2 What is a worker Node?

2.2 Deploying workloads in Kubernetes 2.2.1 Deploying a workload

2.2.2 Deployment objects

2.2.3 Volume

2.3 Managing application configuration 2.3.1 ConfigMaps

2.4 Using Kubernetes Secrets to store sensitive information 2.4.1 Secrets are encoded in Base64

2.4.2 Secrets are mounted in a temporary file system

2.4.3 Secrets can be encrypted at rest

2.4.4 Risks

Summary

Part 2 Managing Secrets 3 Securely storing Secrets 3.1 Storing Kubernetes manifests at rest 3.1.1 Capturing resources for declarative configuration

3.2 Tools for securely storing Kubernetes resources 3.2.1 Ansible Vault

3.3 Kubernetes Operators 3.3.1 Custom resource definitions (CRDs)

3.3.2 Sealed Secrets

3.4 Managing Secrets within Kubernetes package managers 3.4.1 Deploying the Greeting Demo Helm chart

3.4.2 Using Helm Secrets

3.5 Rotating secrets 3.5.1 Ansible Vault secret key rotation

3.5.2 Sealed Secrets key rotation

3.5.3 SOPS secret key rotation

Summary

4 Encrypting data at rest 4.1 Encrypting secrets in Kubernetes 4.1.1 Data at rest vs. data in motion

4.1.2 Plain secrets

4.1.3 Encrypting secrets

4.1.4 Creating the secret

4.2 Key management server 4.2.1 Kubernetes and KMS provider

4.2.2 Creating the secret

Summary

5 HashiCorp Vault and Kubernetes 5.1 Managing application secrets using HashiCorp Vault 5.1.1 Deploying Vault to Kubernetes

5.1.2 Deploying an application to access Vault

5.2 Kubernetes auth method 5.2.1 Configuring Kubernetes auth

5.2.2 Testing and validating Kubernetes auth

5.3 The Vault Agent Injector 5.3.1 Configurations to support Kubernetes Vault Agent injection

Summary

6 Accessing cloud secrets stores 6.1 The Container Storage Interface and Secrets Store CSI Driver 6.1.1 Container Storage Interface

6.1.2 Container Storage Interface and Kubernetes

6.1.3 CSI and secrets

6.1.4 Installing prerequisites

6.1.5 Installing the Secrets Store CSI Driver

6.1.6 Consuming HashiCorp Vault secrets via the Secrets Store CSI Driver and the HashiCorp Vault provider

6.2 Synchronizing CSI secrets as Kubernetes Secrets 6.2.1 Preparing the namespace

6.2.2 Defining a SecretProviderClass resource with secretObjects

6.3 Autorotating secrets to improve security posture 6.3.1 Preparing the namespace

6.3.2 Deploying the Pod with a secret mounted

6.3.3 Updating the secret

6.4 Consuming secrets from cloud secrets stores 6.4.1 Azure Key Vault

6.4.2 GCP Secret Manager

6.4.3 AWS Secrets Manager

Summary

Part 3 Continuous integration and continuous delivery 7 Kubernetes-native continuous integration and Secrets 7.1 Introduction to continuous integration

7.2 Tekton 7.2.1 Installing prerequisites

7.2.2 Installing Tekton

7.2.3 Tekton pipelines

7.3 Continuous integration for a welcome message 7.3.1 Compiling and Running tests

7.3.2 Building and Pushing the container image

7.3.3 The PipelineResource

7.3.4 Pipeline

7.3.5 PipelineRun

Summary

8 Kubernetes-native continuous delivery and Secrets 8.1 Introduction to continuous delivery and deployment

8.2 Continuous delivery for the welcome message 8.2.1 Deploying the Name Generator service

8.2.2 DevOps and GitOps

8.3 Argo CD 8.3.1 Installation of ArgoCD

8.3.2 Welcome service and GitOps

8.3.3 Creating a Welcome Message service from a Git repository

8.3.4 Updating the Welcome service

Summary

appendix A Tooling A.1 Minikube

A.2 Kubectl

appendix B Installing and configuring yq B.1 Installing yq

B.2 yq by example

appendix C Installing and configuring pip C.1 Installing pip

C.2 Basic pip operations

appendix D Installing and configuring Git D.1 Installing Git

D.2 Configuring Git

appendix E Installing GPG E.1 Obtaining the GPG tools

E.2 Generating a public–private key pair

Fair Use Sources:

• Kubernetes Secrets Management on DuckDuckGo
• B0BPTHW6P4 (K8SScrtMg 2023)