Sharing secret keys in Docker containers and K8s

Sharing secret keys in Docker containers and K8s
José Manuel Ortega
Security researcher

Jose Manuel Ortega
Software engineer,
Freelance

1.Challenges of security and secret keys in containers
2.Best practices for saving and securing distribution of
secrets in Docker Containers
3.Managing secrets in Kubernetes using volumes and
sealed-secrets
4.Other tools for distributing secrets in containers

Challenges of security and secret keys in containers

Challenges of security and secret keys in containers
● Secrets play a critical role in storing sensitive data separately from
application code. This includes data such as passwords,
hostnames, SSH keys, and more.
● Our application requires a database connection. To do this, it
needs a hostname, username, and password. Furthermore, there's
a different database server for development, testing, and
production.
● With secrets, each environment can provide its own database
information to the applications.

How Docker manages secrets
Docker's implementation of secrets uses the following
features:
● Secrets are created and managed separately from
applications.
● Follows principles of least privileged and need-to-know
access.
● Flexibility to store a variety of different data types.

How Docker manages secrets
$ docker swarm init --advertise-addr
<MANAGER-IP>
$ docker secret create my_secret
/path/to/secret/file
● /run/secrets/<secret_name>

Best practices for saving and securing distribution of
$ docker secret rm my_secret

$ docker service create
--name my_app
--secret
source=my_secret,target=/different/path/to/secret/file,mode
=0400

version: '3.1'
services:
my_app:
image: my_app:latest
secrets:
- my_external_secret
- my_file_secret
secrets:
my_external_secret:
external: true
my_file_secret:
file: /path/to/secret/file.txt

$ docker stack deploy -c docker-compose.yml
secrets1
Creating service secrets1_viewer
$ docker logs $(docker ps -aqn1 -f status=exited)
my_secret

Managing secrets in Kubernetes

Managing secrets in Kubernetes using volumes
apiVersion: v1
kind: Pod
metadata:
name: volume-pod
spec:
containers:
- name: express-test
image: lukondefmwila/express-test:latest
volumeMounts:
- name: secret-volume
mountPath: /etc/config/secret
volumes:
- name: secret-volume
secret:
secretName: my-secret

Managing secrets in Kubernetes using sealed-secrets

apiVersion: v1
kind: Secret
metadata:
name: my-secret
type: Opaque
data:
username: dXNlcg==
password: cGFzc3dvcmQ=

kubeseal --cert=public-key-cert.pem --format=yaml <
secret.yaml > sealed-secret.yaml
● https://github.com/bitnami-labs/sealed-secrets/releases

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: my-secret
namespace: default
spec:
encryptedData:
password: AgBvA5WMunIZ5rF9...
username: AgCCo8eSORsCbeJSoRs/...

$ kubectl apply -f sealed-secret.yaml

Other tools for distributing secrets in containers
● Hashicorp Vault
● Keywhiz
● Akeyless Vault
● Cloud Provider solutions (AWS Secrets
Manager, GCP Secret Manager)

Hashicorp Vault
The key features of the Vault are:
● It encrypts and decrypts data without storing it.
● Vault can generate secrets on-demand for some
operations, such as AWS or SQL databases.
● Allows replication across multiple data centers.
● Vault has built-in protection for secret revocation.
● Serves as a secret repository with access control details.

Keywhiz
● Keywhiz helps with infrastructure secrets, GPG keyrings,
and database credentials, including TLS certificates and
keys, symmetric keys, API tokens, and SSH keys for
external services.
○ Keywhiz Server
○ Keysync
○ Keywhiz CLI
○ Keywhiz automation API

Keywhiz
The key features of Keywhiz are:
● Helps with infrastructure secrets, GPG keyrings, and
database credentials, including TLS certificates and keys,
symmetric keys, API tokens, and SSH keys for external
services.
● Keywhiz Server provides JSON APIs for collecting and
managing secrets.
● It stores all secrets in memory only.

AWS Secrets Manager
The key features of AWS Secrets Manager are:
● Encrypts and decrypts secrets, transmiting securely over TLS.
● Provides client-side caching libraries to improve the
availability and reduce the latency of using your secrets.
● You can configure Amazon VPC (Virtual Private Cloud)
endpoints to keep traffic within the AWS network.

Akeyless Vault
The platform supports two more pillars:
● Zero-Trust Application Access by providing unified
authentication and just-in-time access credentials, allowing
you to secure the perimeter of applications and infrastructure.
● Encryption as-a-Service, allows customers to protect
sensitive personal & business data by applying FIPS 140-2
certified app-level encryption.

Conclusions
● Secrets are an important tool for any container-based
architecture because they help us achieve the goal of
keeping code and configuration separate.
● Manage secrets in secure storage

Sharing secret keys in Docker containers and K8s

Recommended

More Related Content

Similar to Sharing secret keys in Docker containers and K8s (20)

More from Jose Manuel Ortega Candel (20)

Recently uploaded (20)

Sharing secret keys in Docker containers and K8s