Use SSL/TLS—when running etcd in a cluster, you must use secure peer-to-peer communication. You can’t share the manifest file or check it into a repo—commonly, secrets are configured using JSON or YAML files, with the secret encoded in base64. If you share or check in these manifest files, the secret is compromised.
Where do you keep Kubernetes secrets?
When you create a Secret with kubectl create -f secret. yaml , Kubernetes stores it in etcd. The Secrets are stored in clear in etcd unless you define an encryption provider. When you define the provider, before the Secret is stored in etcd and after the values are submitted to the API, the Secrets are encrypted.
How can we protect our secrets?
- Identify What Needs Protection. …
- Label Documents That Contain Protected Information. …
- Monitor Where Information is Stored. …
- Secure Computers. …
- Maintain Secrecy With Outside Vendors. …
- Provide Adequate Security. …
- Limit Public Access to the Company.
