Kubernetes Security – Best Practice Guide

Re:Kubernetes Security – Best Practice Guide by corpMaverick on Thursday April 05, 2018 @11:56AM (#16766057)

Not included, but I would like to see how to inject secrets when running an image.

[ Parent | on HN ]

Re:Kubernetes Security – Best Practice Guide by jeffstephens on Thursday April 05, 2018 @01:53PM (#16767193)

Kubernetes has great built-in support for injecting secrets as either environment variables (like API keys) or volume mounts (for things like certs). You can configure them to be encrypted at rest as well.

https://kubernetes.io/docs/concepts/configuration/secret/

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...

[ Parent | on HN ]

Re:Kubernetes Security – Best Practice Guide by raesene9 on Thursday April 05, 2018 @03:00PM (#16767924)

one thing to watch there is that you have to be using a relatively recent version (1.9+ IIRC) to get encrypted at rest for secrets in base Kubernetes

[ Parent | on HN ]

Re:Kubernetes Security – Best Practice Guide by Diederich on Thursday April 05, 2018 @12:31PM (#16766371)

At image startup you mean? Or while the image is actively running.

[ Parent | on HN ]

Re:Kubernetes Security – Best Practice Guide by ownagefool on Thursday April 05, 2018 @02:23PM (#16767541)

If you use the file based secrets(or configmap), they'll be updated when the underlying secrets are.

Obviously your code would have to handle using these new secrets and not just simply read the file at startup.

[ Parent | on HN ]