Kubernetes: how do I manage secrets safely?
posée 3 months ago72 vuesen
Kubernetes Secrets are just base64-encoded. I don't want DB passwords sitting in plain YAML in our git repo. What's the recommended approach?
Diagnostic IA
Généré par IA. Ce n'est pas une réponse — la communauté ci-dessous le confirme ou le corrige. Vérifiez toujours avant de vous y fier.
1 réponse
Correct, base64 is encoding, not encryption. Layered approach:
1. Never commit plain Secrets. Choose one of: - External Secrets Operator: syncs from AWS Secrets Manager, Azure Key Vault, GCP Secret Manager or Vault into K8s Secrets. Git only holds a reference. - Sealed Secrets or SOPS (with age/KMS): encrypted secrets that are *safe* to commit and decrypted in-cluster. 2. Enable encryption at rest for etcd (managed clusters usually do this; verify it). 3. RBAC: restrict get/list on Secrets. Many people with namespace access can otherwise read them all. 4. Prefer workload identity (IRSA on EKS, Workload Identity on GKE/AKS) so pods authenticate to cloud services without long-lived keys at all. 5. Mount secrets as files rather than env vars where possible, since env vars leak into crash dumps and debug output.
Connectez-vous pour dire si ça a marché.
Sign in and verify your email to post an answer.