Container secrets talk from DevSecCon
Download as PPTX, PDF1 like561 views
The document discusses best practices for managing secrets in containerized environments, emphasizing encryption, access control, and lifecycle management of secrets. It covers various orchestration platforms like Docker, Kubernetes, and Nomad, detailing their respective approaches to secret management, including built-in support and integration with external storage like HashiCorp Vault. Key recommendations include avoiding the exposure of secrets in source code and environment variables, ensuring secure configurations, and implementing role-based access control.
Container secrets talk from DevSecCon
- 1. Join the conversation #DevSecCon Your (container) secret’s safe with me Liz Rice, Aqua Security @lizrice
- 4. Desirable attributes for secrets management
- 5. 5 Secrets @LizRice | @AquaSecTeam Secrets photo: Katie Tegtmeyer ■ Encrypted ■ At rest and in transit ■ Only decrypted in memory
- 6. 6 Secrets @LizRice | @AquaSecTeam Secrets photo: James Case ■ Access control ■ Only accessible by containers that need them ■ And users ■ Write-only access
- 7. 7 Secrets @LizRice | @AquaSecTeam Secrets photo: Irena Jackson ■ Life-cycle ■ Risk of leak increases over time ■ Rotation, revocation, audit logging
- 8. Passing secrets to containers
- 9. 9 Bad places for secrets @LizRice | @AquaSecTeam ■ Source code ■ Dockerfiles / images
- 10. 10 docker run -e VARNAME=secret ... Environment variables @LizRice | @AquaSecTeam
- 11. 11 ■ docker inspect ■ docker exec ■ /proc directory ■ Leaky logs Environment variables @LizRice | @AquaSecTeam
- 12. 12 docker run -v /hostsecrets:/secrets ... Mounted volume @LizRice | @AquaSecTeam
- 13. 13 ■ docker inspect ■ docker exec ■ /proc directory ■ Leaky logs Mounted volume @LizRice | @AquaSecTeam
- 14. Orchestrator support for secrets
- 15. 15 Docker @LizRice | @AquaSecTeam ■ Secrets support built in for Docker Swarm services ■ Not standalone containers ■ Encrypted transmission with mutual authentication ■ Secret accessible when exposed to service ■ Mounted to a temporary fs (not env vars) ■ RBAC in Enterprise Edition
- 16. 16 Docker @LizRice | @AquaSecTeam ■ Encrypted in Raft log ■ Lock your Swarm!! ■ Shared to Swarm managers ■ Audit log with events ■ Rotation requires container restart & secret dance Encrypted ✓ Access control ✓ Life-cycle ?
- 17. 17 Kubernetes secrets @LizRice | @AquaSecTeam ■ Secret configured in pod YAML ■ Namespaced ■ RBAC can be turned on --authorization-mode=RBAC ■ Files and env vars ■ Files support updating secret values ■ Need to restart pod to get new env var value
- 18. 18 Kubernetes secrets @LizRice | @AquaSecTeam ■ Stored in etcd ■ Make sure secrets are encrypted! ■ --experimental-encryption-provider-config on API Server Encrypted ? Access control ✓ Life-cycle ✓
- 19. 19 Kubernetes secrets @LizRice | @AquaSecTeam kind: EncryptionConfig apiVersion: v1 resources: - resources: - secrets providers: - aescbc: keys: - name: key1 secret: bXlWZXJ5U2VjcmV0RW5jcnlwdGlvbktleQo= - identity: {}
- 20. 20 Secrets all the way down @LizRice | @AquaSecTeam ■ EncryptionConfig holds a secret key... xkcd.com/1416
- 21. 21 DC/OS @LizRice | @AquaSecTeam ■ Enterprise DC/OS ■ Plug-ins for Mesos/Marathon ■ Encrypted in ZooKeeper ■ Env vars ■ Access control by service path ■ Restart service to update value Encrypted ✓ Access control ✓ Life-cycle ?
- 22. 22 Nomad @LizRice | @AquaSecTeam ■ Integrated with Vault ■ Use production mode ■ Encryption & security primitives
- 23. 23 Nomad @LizRice | @AquaSecTeam ■ Secrets passed as files ■ Nomad takes care of interactions with Vault ■ Tasks get tokens so they can retrieve values ■ Poll for changed values ■ Access control ■ Audit logging Encrypted ✓ Access control ✓ Life-cycle ✓
- 24. 24 Aqua secrets & external store @LizRice | @AquaSecTeam ■ Any orchestrator ■ Secret storage in 3rd party backend ■ Hashicorp Vault, Amazon KMS, Azure Key Vault, CyberArk Vault...
- 25. 25 Aqua secrets & external store @LizRice | @AquaSecTeam ■ File system & env var support ■ Update secrets without container restart ■ No env var leak through inspect or /proc ■ Auditing of secret usage ■ User & container access control Encrypted ✓ Access control ✓ Life-cycle ✓
- 26. Summary
- 27. 27 Secrets @LizRice | @AquaSecTeam Secrets photo: Iain Merchant ■ Access secrets at runtime ■ Not built in ■ Rotate secrets ■ Your best option depends on ■ Orchestrator ■ Acceptable level of risk
- 28. Join the conversation #DevSecCon The Ultimate Guide to Secrets Management in Containers tiny.cc/secrets @LizRice | @AquaSecTeam
- 29. 29 Kubernetes secrets access @LizRice | @AquaSecTeam ■ RBAC can be turned on --authorization-mode=RBAC # This role binding allows "dave" to read secrets in the "development" namespace. kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: read-secrets namespace: development # This only grants permissions within the "development" namespace. subjects: - kind: User name: dave apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: secret-reader apiGroup: rbac.authorization.k8s.io