Your (container) secret's safe with me
1 like839 views
This document discusses secrets management in containers. It recommends that secrets be encrypted at rest and in transit, and only accessible to containers that need them with write-only access controls. Secrets should also have lifecycle management like rotation, revocation and audit logging as the risk of a leak increases over time. The document reviews secrets management in Docker, Kubernetes, DC/OS, Nomad and Aqua and notes that the best approach depends on the orchestrator and acceptable risk level.
Your (container) secret's safe with me
- 1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. Your secret’s safe with me Liz Rice @LizRice | @AquaSecTeam
- 3. Desirable attributes for secrets management
- 4. 4 Secrets @LizRice | @AquaSecTeam Secrets photo: Katie Tegtmeyer ■ Encrypted ■ At rest and in transit ■ Only decrypted in memory
- 5. 5 Secrets @LizRice | @AquaSecTeam Secrets photo: James Case ■ Access control ■ Only accessible by containers that need them ■ And users ■ Write-only access
- 6. 6 Secrets @LizRice | @AquaSecTeam Secrets photo: Irena Jackson ■ Life-cycle ■ Risk of leak increases over time ■ Rotation, revocation, audit logging
- 7. Passing secrets to containers
- 8. 8 Bad places for secrets @LizRice | @AquaSecTeam ■ Source code ■ Dockerfiles / images
- 9. 9 docker run -e VARNAME=secret ... Environment variables @LizRice | @AquaSecTeam
- 10. 10 docker run -v /hostsecrets:/secrets ... Mounted volume @LizRice | @AquaSecTeam
- 11. Orchestrator support for secrets
- 12. 12 Docker @LizRice | @AquaSecTeam ■ Secrets support built in for Docker Swarm services ■ Not standalone containers ■ Secret accessible when exposed to service ■ Mounted to a temporary fs (not env vars) ■ RBAC in Enterprise Edition ■ Rotation requires container restart
- 13. 13 Docker @LizRice | @AquaSecTeam ■ Encrypted in Raft log ■ Lock your Swarm!! ■ Shared to Swarm managers ■ External secrets stores coming ■ Encrypted transmission with mutual authentication
- 14. 14 Kubernetes secrets @LizRice | @AquaSecTeam ■ Secret configured in pod YAML ■ Mounted as a volume or configured as env var ■ Namespaced
- 15. 15 Kubernetes secrets @LizRice | @AquaSecTeam ■ Stored in etcd ■ Make sure secrets are encrypted! ■ --experimental-encryption-provider-config on API Server
- 16. 16 Kubernetes secrets @LizRice | @AquaSecTeam kind: EncryptionConfig apiVersion: v1 resources: - resources: - secrets providers: - aescbc: keys: - name: key1 secret: bXlWZXJ5U2VjcmV0RW5jcnlwdGlvbktleQo= - identity: {}
- 17. 17 Secrets all the way down @LizRice | @AquaSecTeam ■ EncryptionConfig holds a secret key... xkcd.com/1416
- 18. 18 Kubernetes secrets access @LizRice | @AquaSecTeam ■ RBAC can be turned on --authorization-mode=RBAC # This role binding allows "dave" to read secrets in the "development" namespace. kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: read-secrets namespace: development # This only grants permissions within the "development" namespace. subjects: - kind: User name: dave apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: secret-reader apiGroup: rbac.authorization.k8s.io
- 19. 19 DC/OS @LizRice | @AquaSecTeam ■ Enterprise DC/OS ■ Plug-ins for Meson/Marathon ■ Encrypted in ZooKeeper ■ Env vars ■ Access control by service path ■ Restart service to update value
- 20. 20 Nomad @LizRice | @AquaSecTeam ■ Integrated with Vault ■ Tasks get tokens so they can retrieve values from Vault ■ Poll for changed values ■ Access control
- 21. 21 Aqua secrets @LizRice | @AquaSecTeam ■ Any orchestrator ■ Secret storage in 3rd party backend ■ Hashicorp Vault, Amazon KMS, Azure Key Vault, CyberArk Vault... ■ File system & env var support ■ Env vars injected into container process memory ■ Secret can be injected to a tempfs filesystem ■ Update secrets without restart of container ■ Auditing of secret usage ■ Limit access to designated containers ■ User access controls
- 22. Summary
- 23. 23 Secrets @LizRice | @AquaSecTeam Secrets photo: Iain Merchant ■ Your best option depends on ■ Orchestrator ■ Acceptable level of risk
- 24. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. The Ultimate Guide to Secrets Management in Containers tiny.cc/secrets @LizRice | @AquaSecTeam