GitOps keeping it secret

We all love GitOps - it simplifies a lot of our existing workflows. But when everything is committed to Git - how do we keep sensitive information secure? You don’t want to keep any secrets in Git where they are left open to anyone who has access to your repo. If you are embracing GitOps in your organization, application secrets should be protected somehow. How can we store those files on Git while keeping them secure? Join me to learn how!

Transcript

1. June 2020 Omer Levi Hevroni| AppSec Engineer| @omerlh Keeping a Secret – The GitOps Way
2. @omerlh
3. Manifests Files Code Traditional Deployment Kubernetes Icons Source: Kubernetes Community, Apache 2 license @omerlh Secret
4. Manifests Files Code A GitOps Deployment Kubernetes Icons Source: Kubernetes Community, Apache 2 license @omerlh
5. Manifests Files Code A GitOps Deployment Kubernetes Icons Source: Kubernetes Community, Apache 2 license @omerlh Secret
6. How do we keep a secrets?
7. I’m a builder @omerlh
8. AppSec Engineer @ Snyk @omerlh
9. The Problem With Git https://www.specbee. com/blogs/git-best- practices-how-make- most-git
10. OWASP Top 10
11. Kubernetes Secrets @omerlh
12. https://kubernetes.io/docs/concepts/configuration/secret/ @omerlh
13. Secrets File Manifest @omerlh
14. Well, that complicates things… http://i.imgur.com/5ebYy62.jpg @omerlh
15. confidential A place for an image • Secrets that can be committed • Transparent for the app • Multiple solutions: • Helm Secrets • Sealed Secrets Encrypted Secrets? @omerlh
16. A Sealed Secret @omerlh
17. @omerlh
18. • Key Management • Sealed Secret – Single keypair per deployment • Helm Secrets – Using SOPS • Coupling to a specific tool/cluster • Changes to secret requires decryption permissions Challenges @omerlh
19. @omerlh
20. Travis Encrypted Secrets https://docs.travis-ci.com/user/encryption-keys/ @omerlh
21. Eureka! http://theunprofessionalblog.blogspot.com/2016/04/whatsapp-this-is-killing-me.html @omerlh
22. Kamus Travis secret encryption – for Kubernetes
23. • An open source project by Soluto • Allows to encrypt a secret for a specific application • Leveraging cloud encryption service (AWS/GCP KMS, Azure KeyVault) • HSM support • CRD support – for creating Kubernetes secrets What? @omerlh
24. Service Account Token (JWT) @omerlh
25. Encrypting for a specific application @omerlh
26. Manifests Files Code A GitOps Deployment Kubernetes Icons Source: Kubernetes Community, Apache 2 license @omerlh Secret (encrypted)
27. Kamus? @omerlh
28. Permissions Model Encrypt Decrypt User Yes No Pod Yes Only it’s secrets @omerlh
29. Templating Support @omerlh
30. KamusSecret @omerlh
31. Storing a Reference Only confidential @omerlh
32. confidential External Secret @omerlh https://github.com/godaddy/kubernetes-external-secrets
33. Wrapping Up confidential @omerlh
34. Manifests Files Code A GitOps Deployment Kubernetes Icons Source: Kubernetes Community, Apache 2 license @omerlh Secret
35. Solutions Kubernetes Secret (?) Sealed Secret External Secret @omerlh Kamus
36. How do we keep a secrets? @omerlh
37. Thank You @omerlh