Secure Your Secrets in GitOps

Learn how to inject secrets into your applications with Flux, a GitOps tool on Kubernetes.

Transcript

1. Copyright © 2022 HashiCorp Secure Your Secrets in GitOps May 19, 2021 Rosemary Wang Developer Advocate at HashiCorp she/her @joatmon08 1
2. Works, but not ideal. Use SOPS to encrypt and store in version control. 1 2 3 fluxcd.io/docs/guides/mozilla-sops/#encrypting-secrets-using-hashicorp-vault SOPS 2. Commit encrypted secret to version control. 1. Use encryption key from Vault to encrypt secret. 2
3. What happens when you accidentally commit a plaintext secret? 3
4. 1. Regret 2. Revoke 3. Rotate 4. Reference 5. Replace 6. Re-run Plan R AKA Remediation 4
5. Is there a better way? 5
6. Kubernetes Secret Plaintext 😨 Needs role-based access controls 🤔 Secrets Manager Securely stores secrets (Some) Rotate secrets for you Audits access Securing Secrets Credentials, Tokens, Keys, Certificates 6
7. Secrets Manager + Kubernetes Use file-based secrets injection with Secrets Store CSI Driver. 1 2 3 secrets-store-csi-driver.sigs.k8s.io/ vaultproject.io/docs/platform/k8s/csi @joatmon08 7
8. If you still need Kubernetes secrets… Sync as Kubernetes Secret with Secrets Store CSI Driver. 1 2 3 8
9. github.com/ joatmon08/ hashicorp-vault-flux 9
10. 1. hashicorp.com/blog/manage-kubernetes-secrets- for-flux-with-hashicorp-vault 2. fluxcd.io/docs/guides/mozilla-sops/#encrypting-s ecrets-using-hashicorp-vault 3. secrets-store-csi-driver.sigs.k8s.io/ 4. vaultproject.io/docs/platform/k8s/csi 5. vaultproject.io/docs/platform/k8s/injector Resources 10
11. Copyright © 2022 HashiCorp Thank you! May 19, 2021 Rosemary Wang @joatmon08 joatmon08.github.io 11