[ Kube 14 ] Using Secrets in Kubernetes

[@damianrodriguez9553]

I was searching for ways to keep secrets updated without needing to restart my pods and you gave me the answers. Thank you

[@justmeandopensource]

Hi Damien, no worries. Thanks for watching.

[@shayberkovich8104]

Venkat, for that thing where you were surprised that the secret got updated in the pod this is how it supposed to work for volume-mounted secret. Perhaps earlier you have tried updating a secret mounted through env variable. Those won't get updated.

[@justmeandopensource]

Hi Shai, thanks for watching this video and taking time to comment. Yes you are right. The reason I was surprised is that when I was doing a test run of this video, it behaved differently. Thanks, Venkat

[@richardwang3438]

yes, env won't get updated, but volume can be updated dynamically

[@justmeandopensource]

Yeah I realized that later. Thanks.

[@waterkingdom9839]

Excellent Kubernetes Videos. Very easy to follow by a novice. One small request if a dedicated video can be created for Ingress Controller.

[@justmeandopensource]

Hi, thanks for watching this video. I have done couple of videos on ingress topic. One based on Nginx ingress and the other on Traefik. Please find them in the below links. kzbin.info/www/bejne/mZnaoJmvfNdrZsU kzbin.info/www/bejne/d5Czm515gpaYgqM Thanks

[@RK-wk6zn]

thanks for such a simple presentation. i am practicing these steps after watching this video.

[@justmeandopensource]

Hi, thanks for watching this video.

[@jagadeesh0014]

Really, it helps a lot to me to understand the secrets concept in Kubernetes, can you please upload for volumes video as well, please ignore if you are already done this.

[@justmeandopensource]

Hi Jagan, thanks for watching. Here is my full kubernetes playlist kzbin.info/www/bejne/j6vEiqSujJWqfdU And here is a video about dynamic volume provisioning kzbin.info/www/bejne/eneWp2WGbaqBe8k

[@ThamaraiselvamT]

Whoa.. I am learning k8s.

[@justmeandopensource]

Hi Thamarai, you are welcome and thanks for your interest in this series.

[@debiprasadmohanty8782]

thanks for such a simple presentation

[@justmeandopensource]

Hi, Thanks for watching this video.

[@TheGauravgulati22]

Nicely explained...thanks

[@justmeandopensource]

HI Gaurav, thanks for watching.

[@vivekgautam9672]

Hi Venkat. Thanks for putting all the videos together. They are great and very helpful!. I was reading through comments from other people and some was asking about using "Vault" for secret source. are u still planning on doing that video?

[@justmeandopensource]

Hi Vivek, Thanks for watching. Yes, Vault is in my list. Will cover it at some point. Cheers.

[@joeb.1163]

thank you very much, your content is very useful..

[@justmeandopensource]

Hi Joe, thanks for your interest in this channel. Cheers.

[@Peter-xn9bk]

Tks Venkat so much

[@justmeandopensource]

You are welcome and thanks for watching this video.

[@romantsyupryk3009]

Thanks so much for this tutorial.

[@justmeandopensource]

Hi Roman, thanks for watching.

[@laurentprat8219]

Hi venkat, thank you for your video, clear and straight to the point. I have a question about the base64 encoding while defining the secret, is it what it is required to get it converted into the pod. I wonder if you could have something a bit stronger than base64 to encoded the secret, because that is really easy to decode for anyone having access to the secret definition file

[@justmeandopensource]

Hi Laurent, Thanks for watching my video and thanks for bringing this to the table. Very valid point. By default Kubernetes secrets are all base64 encoded. And can be accessed and decoded by anyone having access to the cluster. Well you can fine tune acess control like creating a namespace and creating secrets in that namespace. Then restrict access to those who want it for that namespace. And in that namespace restrict access to properties like "watch", "get", "list" for the secret resource. But those add lot more complexities and still its not the best way. None of the nodes in the cluster will store the secrets in their local filesystem anywhere. When a pod requests a secret, it gets pulled from the etcd datastore and stored in tmpfs (temporary filesystem in memory) and get removed after the lifecycle of the pod. So basically the secrets are stored in plaintext in the etcd datastore. If you are not aware of etcd, its a datastore where Kubernetes cluster data is stored as key value pairs. If you have access to the etcd node, you can retrieve those secrets using etcdctl command I think. If you want to encrypt the secrets in etcd datastore you can follow below link, kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ Or you can use Key Management Service (KMS) for encrypting data in the etcd. AWS has KMS service. Still it doesn't solve the main issue you pointed out. For that I think Hashicorp's Vault service may give some security. But I haven't tried it yet. Basically you run this Vault service either within Kubernetes cluster or externally on a virtual machine or physical server. You can then use the Vault to store secrets. Thanks, Venkat

[@shayberkovich8104]

Thats what Kubernetes uses to store the secrets - base64 encoding and it is not supposed to substitute encryption. In fact, Kubernetes does not encrypt the secrets by default and they are stored unencrypted at rest. There is a separate object starting v1.7 called EncryptionConfig that can be used to encrypt secrets at rest (i.e. in etcd).

[@waterkingdom9839]

Hello Venkat, just curious to know if you are planning to record a video on integrating Hashi Corp Vault with Kubernetes. As you know the limitations of secrets, enterprises are more inclined towards using Vault. Looking forward to your inputs.

[@justmeandopensource]

Yeah. I was covering the fundamental concepts in K8s. And vault is in my to do list. Thanks for reminding me.

[@waterkingdom9839]

@@justmeandopensource when do you plan to record it? I know now you are focusing on MongoDB tutorials.

[@justmeandopensource]

@@waterkingdom9839 MongoDB is a separate series. My commitment is to release a video every Monday for Kubernetes and one for MongoDB. I have another 4 for k8s waiting to be released in the coming Mondays. Even if I record now, it will be released after 5 weeks. Thanks.

[@waterkingdom9839]

@@justmeandopensource OK...looking forward to your new videos.

[@justmeandopensource]

@@waterkingdom9839 Thanks.

[@abhishekbhati4334]

very good

[@justmeandopensource]

Thanks for watching Abhishek.

[@atulbarge7445]

Hello Venkat, can you please create or give some idea for how to connect local on a prime MySQL database to the Kubernetes cluster or pod

[@balasekharnelli9218]

People who have access to the repo where we pushed our secrets can decode the password. How to overcome this?

[@justmeandopensource]

Hi Bala, thanks for watching this video. Yes in Kubernetes if you secrets, they are not really secrets unless you protect your repository and use it in a namespace where you restrict users. Otherwise you can use Hashicorp's Vault for managing secrets externally. There is a good blog post about it which you can check in the below link. blog.kubernauts.io/managing-secrets-in-kubernetes-with-vault-by-hashicorp-f0db45cc208a Thanks.

[@balasekharnelli9218]

@@justmeandopensource Thanks, Venkat. Really appreciate your help.

[@justmeandopensource]

@@balasekharnelli9218 No worries. You are welcome.

[@travelersnotebook3503]

Video Request: hashicorp vault

[@justmeandopensource]

Thanks. I will add it to my list.

[@rahul_bali]

make a video for using certificates in secrets

[@justmeandopensource]

Hi Rahul, thanks for watching. I will add it to my list. Cheers.

[@rahul_bali]

I am stuck at this.. There is scarce info about it.. There is only tls.crt and tls.key What if I have only signed ca.crt from the CA directly?

[@PhaniKumarRaja]

Hi Venkat how to create k8s secret from private key json file (which has special characters )

[@ram-rg4fs]

How to connect AWS postgresql to a deployment.environment kops

[@faisalbeenhossain9223]

What if I skip this line: args: ["-c", "sleep 600"]

[@justmeandopensource]

Hi Faisal, thanks for watching. Have you checked what if you skip that line? Basically I want the busybox container to run for some time before exiting as I want to test the secrets mounted. If you skip that line, the pod will error/crashloopbackoff. Just try it and see it for yourself. Cheers.

[@Rosepoision]

Can we do the same , where it provision the vms on ur laptop or let say if i clone then on google cloud vm then what will be the case

[@jimmyho9649]

may I know how to use secret to store privatekey etc ?

[@himanshumasih6307]

Hi Sir, i have created the secret file but the problem is in mine the secret file is stored inside pod as .yaml file and i can not access its contents the way you are accessing, please help, actually i need to use the credentials in another script.

[@richardgomes5420]

base64 is not encryption, but encoding. If you store your secret.yaml into the source control and I have access to your files, I can decode your password, since it was never encrypted, but it was encoded. So, never, never store secrets in the source control which contain opaque passwords. Even if you do not store secret.yaml files into the source control but I have access to etcd file storage, I'm able to grab your passwords because opaque secrets can be easily decoded. Once again, base64 is not encryption, but encoding. I just need to tell base64 to decode a string and hack done... I have your password. The problems is: opaque secrets are not secure, does not matter how you create it. Opaque secrets are not secure. Period.

[@justmeandopensource]

Thanks for the clarification. I understand its not encryption but encoding.

[@rayudu2080]

Hi

[@justmeandopensource]

Hello

[@rayudu2080]

@@justmeandopensource I need some help for how to pass kubernets secret value into deployment yaml, can you please help me out please

[@tiagosantos2136]

With ENV i habe access to $ENV_VARIABLE, how about VOLUME SECRETS, how i use them?