Encrypting Secrets the Kubernetes-Native Way

In the previous two chapters, we have reviewed together the foundational knowledge regarding the architecture, implementation, and usage of Secret objects within the Kubernetes architecture and design. We also established that Secret objects are not safe as-is within Kubernetes platforms due to their unencrypted nature, both in terms of key-value pair and the etcd data file, resulting in major security exposures for your business.

In this chapter, we will get closer to both Kubernetes and etcd, understanding their associated security weaknesses and how we can mitigate or reduce them. While these responses could be considered tightly coupled with the container platform deployment, thanks to the open source nature of the operating system and Kubernetes distribution, most if not all can be applied widely.

This chapter focuses on an in-platform approach, starting with the Kubernetes-native encryption design, including the possibility to...