Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Why kubernetes secret needs to be encrypted?

1

Based on this article (link), Implementing envelope encryption is considered a security best practice for applications that store sensitive data and is part of a defense in depth security strategy.

But from what I know, etcd (where kubernetes secret stored) is part of control plane and control plane is managed by AWS (link). Should it be secure already ? Why do we need to encrypt it?

Topics
Security, Identity, & ComplianceContainersAWS Well-Architected Framework
Tags
EncryptionAWS Secrets ManagerAmazon Elastic Kubernetes ServiceSecurity
Language
English

asked 4 years ago1.2K views

2 Answers
2

Everything in the cloud follows shared responsibility model.

Nothing should be assumed secure "already".

etcd is indeed managed by AWS, but AWS does not implement by default additional encryption on top of whatever Kubernetes has.

Secrets is one of the worst names in my opinion in K8s. By default secrets are stored in a base64 encoded format in etcd. It's not safe as it can be decoded very easily.

If it indeed is secret, you should encrypt it before it's being stored in etcd.

Maybe the official document explains this very well -

Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.

answered 4 years ago

EXPERT

reviewed 2 years ago

  • apriliopajri
    4 years ago

    hi @Jason_S. thank you for your answer. so person who can exploit this is anyone who is authorized to create a Pod in a namespace.

    I have more question. You mention that "Anyone with API access can retrieve or modify a Secret". What API do you refer to ? Is it API call between pod or something else ?

  • Jason_S
    4 years ago

    Hi - that would be get GET operation for secrets. It's an API call made to the control plane. You can restrict access through RBAC / ABAC. Of course, you should ALWAYS encrypt secrets regardless of your access policies. https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/

  • Jatin Mehrotra
    4 years ago

    I think this answer is misleading because in the documentation it is clearly mentioned All of the data stored by the etcd nodes and associated Amazon EBS volumes is encrypted using AWS KMS.which means encryption of etcd nodes is managed by AWS managed keys and Kubernetes stores data in etcd encrypted but EKS encrypts it.

0

Kubernetes does not encrypt data by default by storing in etcd volume, however when using EKS it will encrypt data by default for all etcd volumes using EBS encryption. Secrets encryption is an additional encryption which means underlying data and secrets are already encrypted.

Enter image description here

answered 4 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content