How to deploy secrets in Kubernetes

Introduction

In the complex landscape of Kubernetes container orchestration, managing sensitive information securely is crucial for maintaining robust and protected applications. This tutorial provides comprehensive guidance on deploying secrets in Kubernetes, exploring configuration techniques, security strategies, and best practices for handling confidential data within containerized environments.

Skills Graph

Secret Basics in K8s

What are Kubernetes Secrets?

Kubernetes Secrets are objects that help manage sensitive information such as passwords, OAuth tokens, SSH keys, and other confidential data. They provide a way to separate sensitive configuration data from container images and pod specifications, enhancing security and flexibility in application deployment.

Types of Kubernetes Secrets

Kubernetes supports several types of secrets to accommodate different use cases:

Secret Creation Mechanisms

Secrets can be created through multiple methods:

1. Using kubectl Command

Create a secret directly from the command line:

## Create a generic secret
kubectl create secret generic db-credentials \
    --from-literal=username=admin \
    --from-literal=password=mysecretpassword

## Create a secret from a file
kubectl create secret generic ssl-cert \
    --from-file=tls.crt=server.crt \
    --from-file=tls.key=server.key

2. YAML Configuration

Define secrets in a YAML file for version-controlled deployment:

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
stringData:
  username: admin
  password: mysecretpassword

Secret Encoding

Secrets are base64 encoded to ensure safe storage and transmission:

## Encode a value
echo -n "mysecretpassword" | base64

## Decode a value
echo "bXlzZWNyZXRwYXNzd29yZA==" | base64 --decode

Key Considerations

• Secrets are namespace-scoped
• Maximum secret size is 1MB
• Secrets are stored in etcd and can be encrypted at rest
• Avoid committing secrets to version control systems

Use Cases

1. Database connection credentials
2. API keys and tokens
3. TLS certificates
4. Docker registry authentication

By understanding these basics, you can effectively manage sensitive information in your Kubernetes clusters with LabEx's recommended best practices.

Secret Configuration

Secret Configuration Methods

1. Creating Secrets from Literal Values

## Create a generic secret with literal values
kubectl create secret generic app-credentials \
    --from-literal=DB_USERNAME=myuser \
    --from-literal=DB_PASSWORD=mysecretpassword

2. Creating Secrets from Files

## Create a secret from individual files
kubectl create secret generic ssl-certs \
    --from-file=tls.crt=./server.crt \
    --from-file=tls.key=./server.key

## Create a secret from an entire directory
kubectl create secret generic config-files \
    --from-file=./config-directory

Secret Configuration Strategies

3. Declarative YAML Configuration

apiVersion: v1
kind: Secret
metadata:
  name: database-secret
type: Opaque
stringData:
  DB_HOST: localhost
  DB_PORT: "5432"
  DB_USERNAME: admin
  DB_PASSWORD: securepassword

Consuming Secrets in Pods

Environment Variable Injection

apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
  - name: myapp
    image: myapp-image
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: database-secret
          key: DB_USERNAME

Volume Mount Configuration

apiVersion: v1
kind: Pod
metadata:
  name: secret-volume-pod
spec:
  containers:
  - name: myapp
    image: myapp-image
    volumeMounts:
    - name: secret-volume
      mountPath: "/etc/secrets"
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: database-secret

Secret Types and Configurations

Advanced Secret Management

Immutable Secrets

apiVersion: v1
kind: Secret
metadata:
  name: immutable-secret
type: Opaque
immutable: true
stringData:
  key: value

Base64 Encoding Considerations

## Manually encode secret values
echo -n "mysecretvalue" | base64

Best Practices for Secret Configuration

1. Use environment-specific secrets
2. Rotate secrets regularly
3. Limit secret access
4. Use external secret management tools

With LabEx's comprehensive guide, you can effectively configure and manage Kubernetes secrets for enhanced application security.

Secret Best Practices

Security Recommendations

1. Encryption at Rest

apiVersion: v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets
    providers:
    - aescbc:
        keys:
        - name: key1
          secret: <base64 encoded secret>

2. Access Control Strategies

Secret Management Techniques

Rotating Secrets

## Example secret rotation script
#!/bin/bash
NEW_PASSWORD=$(openssl rand -base64 16)
kubectl create secret generic db-credentials \
    --from-literal=password=$NEW_PASSWORD \
    --dry-run=client -o yaml | kubectl apply -f -

External Secret Management

Secure Secret Handling

Avoiding Common Mistakes

## Bad Practice
apiVersion: v1
kind: Secret
metadata:
  name: bad-secret
stringData:
  password: "plaintext-password"  ## AVOID THIS!

## Good Practice
apiVersion: v1
kind: Secret
metadata:
  name: good-secret
type: Opaque
data:
  password: base64EncodedValue

Monitoring and Auditing

Secret Access Logging

## Enable API server audit logging
kube-apiserver \
  --audit-log-path=/var/log/kubernetes/audit.log \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3

Best Practices Checklist

1. Never commit secrets to version control
2. Use short-lived credentials
3. Implement automatic rotation
4. Minimize secret exposure
5. Use external secret management tools

Advanced Security Configurations

Pod Security Policies

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-secrets
spec:
  readOnlyRootFilesystem: true
  forbiddenSysctls:
  - "*"

Practical Recommendations

1. Use environment-specific secrets
2. Implement strict RBAC policies
3. Encrypt secrets at rest
4. Regularly audit secret access
5. Use immutable secrets when possible

With LabEx's comprehensive guide, you can implement robust secret management in Kubernetes, ensuring maximum security and compliance.

Summary

Understanding and implementing proper secret management in Kubernetes is essential for maintaining application security and operational integrity. By following the outlined best practices, developers and DevOps professionals can effectively protect sensitive information, minimize security risks, and ensure seamless deployment of confidential credentials across Kubernetes clusters.