How to inject secrets into Kubernetes pods

Introduction

In modern cloud-native applications, securely managing sensitive information like credentials and configuration data is crucial. This tutorial provides comprehensive guidance on injecting secrets into Kubernetes pods, helping developers and DevOps professionals implement robust security strategies for managing confidential information within containerized environments.

Secrets in Kubernetes

What are Kubernetes Secrets?

Kubernetes Secrets are objects that help manage sensitive information such as passwords, OAuth tokens, SSH keys, and other confidential data. They provide a way to separate sensitive configuration data from pod and container definitions, enhancing security and flexibility in application deployment.

Types of Kubernetes Secrets

Kubernetes supports several types of secrets to accommodate different use cases:

Secret Management Workflow

graph TD
    A[Create Sensitive Data] --> B[Encode Data]
    B --> C[Create Kubernetes Secret]
    C --> D[Mount Secret in Pod]
    D --> E[Access Secret in Container]

Key Characteristics

• Secrets are namespace-scoped
• Data is base64 encoded
• Can be created manually or automatically
• Support multiple ways of consumption

Example: Creating a Basic Secret

## Create a secret from literal values
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password=mysecretpassword

## Create a secret from files
kubectl create secret generic ssl-cert \
  --from-file=./tls.crt \
  --from-file=./tls.key

Security Considerations

• Secrets are stored in etcd and can be encrypted at rest
• Recommended to use RBAC to limit secret access
• Consider using external secret management tools for advanced scenarios

LabEx Recommendation

For hands-on practice with Kubernetes Secrets, LabEx provides interactive environments that allow you to experiment with secret creation and management in a safe, controlled setting.

Injection Methods

Overview of Secret Injection Techniques

Kubernetes provides multiple methods to inject secrets into pods, each with unique use cases and advantages.

1. Environment Variables

Basic Environment Variable Injection

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
    - name: myapp
      image: ubuntu:22.04
      env:
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: username

2. Volume Mounts

Mounting Secrets as Files

apiVersion: v1
kind: Pod
metadata:
  name: secret-volume-pod
spec:
  containers:
    - name: myapp
      image: ubuntu:22.04
      volumeMounts:
        - name: secret-volume
          mountPath: "/etc/secrets"
          readOnly: true
  volumes:
    - name: secret-volume
      secret:
        secretName: db-credentials

Injection Methods Comparison

3. Projected Volumes

Advanced Secret Projection

apiVersion: v1
kind: Pod
metadata:
  name: projected-secrets-pod
spec:
  containers:
    - name: myapp
      image: ubuntu:22.04
      volumeMounts:
        - name: projected-secrets
          mountPath: "/projected-secrets"
  volumes:
    - name: projected-secrets
      projected:
        sources:
          - secret:
              name: db-credentials
          - secret:
              name: ssl-certs

Secret Injection Workflow

graph TD
    A[Create Kubernetes Secret] --> B{Injection Method}
    B --> |Environment Variables| C[Direct Pod Env]
    B --> |Volume Mount| D[File-based Secrets]
    B --> |Projected Volume| E[Multiple Secret Sources]

Best Practices

• Use volume mounts for larger secrets
• Minimize secret exposure
• Rotate secrets regularly
• Use RBAC to control secret access

LabEx Tip

LabEx provides interactive labs to practice different secret injection techniques in real Kubernetes environments.

Security Best Practices

Kubernetes Secrets Security Framework

1. Encryption at Rest

Implement encryption for secrets stored in etcd:

## Enable encryption at rest
sudo vi /etc/kubernetes/manifests/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- aescbc:
keys:
- name: key1
secret: ${ENCRYPTION_KEY}

2. Access Control Strategies

RBAC Secret Management

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]

Secret Security Matrix

3. Secret Management Workflow

graph TD
    A[Create Secret] --> B{Validate}
    B --> |Pass| C[Encrypt]
    C --> D[Apply RBAC]
    D --> E[Periodic Rotation]
    E --> F[Audit Logging]

4. External Secret Management

Integrating External Secret Managers

• HashiCorp Vault
• AWS Secrets Manager
• Azure Key Vault

5. Runtime Security Practices

Container-Level Protections

• Avoid embedding secrets in container images
• Use short-lived credentials
• Implement least privilege principles

Advanced Secret Handling

## Automatic secret rotation script
#!/bin/bash
CURRENT_SECRET=$(kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d)
NEW_SECRET=$(openssl rand -base64 32)
kubectl create secret generic db-credentials-new --from-literal=password=$NEW_SECRET

Monitoring and Auditing

Tracking Secret Access

• Enable Kubernetes audit logging
• Implement real-time secret access monitoring
• Use security tools for comprehensive tracking

LabEx Security Recommendation

LabEx provides comprehensive labs to practice and validate Kubernetes secret security configurations in controlled environments.

Key Takeaways

• Encrypt secrets at rest
• Implement strict RBAC
• Rotate secrets regularly
• Use external secret management tools
• Continuously monitor and audit secret access

Summary

Understanding and implementing proper secret injection techniques in Kubernetes is essential for maintaining application security. By leveraging Kubernetes' native secret management capabilities and following best practices, teams can effectively protect sensitive data while ensuring seamless deployment and configuration of containerized applications.