Your secret's safe with me

Slide 1

Slide 1 text

Slide 2

Slide 2 text

2 Secrets @LizRice | @AquaSecTeam

Slide 3

Slide 3 text

3 Desirable security features for container secrets ■ Encrypted ■ At rest and in transit ■ Only decrypted in memory ■ Access control ■ Only accessible by containers that need them ■ Life-cycle ■ Rotation, revocation, audit logging @LizRice | @AquaSecTeam

Slide 4

Slide 4 text

4 Secret life-cycle ■ Risk of leak increases over time ■ Exploit ■ Bad actor ■ Accidental logging ■ Change secret values (“rotation”) ■ Token lifetime & use limit @LizRice | @AquaSecTeam

Slide 5

Slide 5 text

5 Tokens all the way down @LizRice | @AquaSecTeam ■ If your secret is in a secret store, how do you get access? ■ How do you keep the access token secret? xkcd.com/1416

Slide 6

Slide 6 text

Passing secrets to containers

Slide 7

Slide 7 text

7 Bad places for secrets @LizRice | @AquaSecTeam ■ Source code ■ Dockerfiles / images

Slide 8

Slide 8 text

8 docker run -v VARNAME=secret ... Environment variables @LizRice | @AquaSecTeam

Slide 9

Slide 9 text

9 docker run -v /hostsecrets:/secrets ... Mounted volume @LizRice | @AquaSecTeam

Slide 10

Slide 10 text

Orchestrator support for secrets

Slide 11

Slide 11 text

11 Docker Swarm @LizRice | @AquaSecTeam ■ Secrets support built in ■ Mounted to a temporary fs ■ Encrypted transmission with mutual authentication

Slide 12

Slide 12 text

12 Docker Swarm @LizRice | @AquaSecTeam ■ Secrets support built in ■ Mounted to a temporary fs ■ Encrypted transmission with mutual authentication ■ Files, not env vars ■ Restart service to change secret value ■ RBAC in Enterprise Edition

Slide 13

Slide 13 text

13 Kubernetes @LizRice | @AquaSecTeam ■ Stored unencrypted in etcd ■ HTTP in transit by default ■ Files and env vars ■ Files support updating secret values ■ Need to restart pod to get new env var value ■ Files mounted into the host ■ RBAC can be turned on --authorization-mode=RBAC

Slide 14

Slide 14 text

14 OpenShift @LizRice | @AquaSecTeam ■ As Kubernetes, but with namespaced projects & RBAC

Slide 15

Slide 15 text

15 DC/OS @LizRice | @AquaSecTeam ■ Encrypted in ZooKeeper ■ Access control by service path ■ Env vars ■ Restart service to update value

Slide 16

Slide 16 text

16 Rancher @LizRice | @AquaSecTeam ■ Experimental secrets support

Slide 17

Slide 17 text

17 Nomad @LizRice | @AquaSecTeam ■ Integrated with Vault ■ Tasks get tokens so they can retrieve values from Vault ■ Poll for changed values ■ Access control

Slide 18

Slide 18 text

18 Aqua secrets @LizRice | @AquaSecTeam ■ Any orchestrator ■ Secrets encrypted in Vault, Amazon KMS or Aqua DB ■ Env vars injected into container process memory ■ Secret can be injected to a tempfs filesystem ■ Supports updating secrets without restart of container ■ Supports monitoring of secret usage ■ Limit access to designated containers

Slide 19

Slide 19 text

Summary

Slide 20

Slide 20 text

20 Secrets decisions @LizRice | @AquaSecTeam Your best option depends on ■ choice of orchestrator ■ acceptable level of risk Aqua White Paper on secrets management coming very soon