Summary

While security measures depend on the organization’s compliance and regulation requirements, a risk-based assessment will define the appropriate actions to harden your information systems. However, securing Kubernetes Secrets is not optional but a must.

Given the current trend of adopting hybrid multi-cloud patterns, having one cluster’s etcd compromised, whether it is on the cloud or self-managed, could lead to compromising the entire environment. These types of attack leverage in-cluster network connections or a fleet management tool for which the token would be recorded within the compromised etcd. Such a scenario would lead to a viral attack infecting every connected endpoint.

As a remediation, the native Kubernetes encryption – more specifically, the kms provider – is a best practice security pattern supported by all the major cloud and software providers.

Remember, security is not a finite game but a continuous effort. Regular audits...