How can I minimize administrator access to secrets in kubernetes?

Question

AFAIK administrators can use exec to execute commands in a container running in kubernetes. This means that they can see all the secrets correct?

Now if the secret is used to connect to something externally, which that administrator does not have access to, how can I avoid that the adminstrator gets access to that external system?

Do I need to use something like Hashicorps Vault?

VonC · Accepted Answer · 2018-04-11 04:53:29Z

1

Do I need to use something like Hashicorps Vault?

Generally, yes: you need an external encrypted source in order to separate secret management (readable by admins with the right RBAC) and secrets.

For instance, something like hashicorp/vault-plugin-auth-kubernetes can help and allows for Kubernetes Service Accounts to authenticate with Vault.

answered Apr 11, 2018 at 4:53

VonC

1.4m569 gold badges4.8k silver badges5.7k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

bits Over a year ago

If admin can get the service account token and then use it to authenticate with vault plugin, how is that preventing admin from seeing secrets in vault?

VonC Over a year ago

@bits It won't (a cluster-admin can access anything in his/her cluster). But the reason I was thinking about Vault as an external secret manager is because of mfa (vaultproject.io/docs/auth/mfa.html): multiple factor authentication. That could at least mitigate the admin access.

Collectives™ on Stack Overflow

How can I minimize administrator access to secrets in kubernetes?

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related