HashiCorp and Google: easing secret and infrastructure management

Re:HashiCorp and Google: easing secret and infrastructure ma... by jaxxstorm on Tuesday September 19, 2017 @05:20PM (#15288919)

kubernetes "secrets" are base64 encoded only, anyone with access to the resource can view the original secret.

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by jesseendahl on Tuesday September 19, 2017 @08:28PM (#15289861)

The lack of encryption at rest for Kubernetes secrets was one of the (many) factors in why we originally chose Vault.

That said, there's been a lot progress recently in this area recently. Starting in Kubernetes 1.7, you can optionally encrypt etcd at rest: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...

You also have a few good choices for the crypto. Two of the choices are Secret Box (XSalsa20 + Poly1305) and AES-GCM with random nonce.

Full list of providers, including info on strength + other considerations:

[ Parent | on HN ]