How to Encrypt Secret Data at Rest in Kubernetes

Data encryption is a process of transforming readable data into an unreadable format. This is done in order to protect the data from unauthorized access. Data encryption at rest refers to the process of encrypting data when it is not being used, such as when it is stored on a disk or backup storage system.

Photo by Life Of Pix on Pexels

There are many benefits to encrypting data at rest, including increased security and privacy, deterring cyber-attacks, and complying with regulations. However, there are also some challenges associated with data encryption at rest, such as managing keys and ensuring compatibility with applications.

In this blog post, we will discuss how to encrypt secret data at rest in Kubernetes. We will cover two methods of encrypting secret data: using an encryption key and using a secrets file. We will also provide instructions on how to rotate encryption keys for data encryption at rest in Kubernetes.

What is data encryption at rest.

What are the challenges of data encryption at rest.

Data encryption at rest is a process of encrypting data that is not currently in use. This type of encryption is often used to protect sensitive data, such as credit card numbers or social security numbers, that is stored on a computer or other electronic device. The benefits of data encryption at rest include increased security and privacy for the users of the encrypted data. The challenges of data encryption at rest include the potential for lost or forgotten keys, as well as the need for extra processing power to encrypt and decrypt the data.

How does this look in Kubernetes? Let’s check it out

As always we will need somethings for this to work

• Encryption Configuration File as far as the key for this file or most importance is the provider you plan on using for encryption note that the documentation calls out that Key Management System (strongest – and recommended)
• Editing the kube-apiserver with the following values added to the command in YAML –encryption-provider-config=<location of your file>, the volumeMounts value along with readOnly as “true”, volumes with the type DirectoryOrCreate.

So first lets run a configuration file this should look similar on what you’d like to encrypt.

head -c 32 /dev/urandom | base64

The value once you get this pass this into the encryption configuration file below under key1.

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aesgcm:
          keys:
            - name: key1
              secret: KZZEHvzbNOx8AtXoFSYRDOryhJfWiSJlHO8yP+OLMJc=
      - identity: {}

Now lets run to the kube-apiserver to update the flags with –encryption-provider-config, move the file we created to /etc/kubernetes/enc/ folder on the control plane no worries this will show below

Then update our volumes to the picture below

Wait for the kube-apiserver to restart and update to our encryption configuration

systemctl restart kubelet

I ran the following to try and speed up the process for this

Okay looks like we are back online so let’s verify our encryption works follow the next command

kubectl create secret generic secretk8s -n default --from-literal=db_admin=sugar

Okay so now that’s out of the way lets run the next command

ETCDCTL_API=3 etcdctl \
   --cacert=/etc/kubernetes/pki/etcd/ca.crt   \
   --cert=/etc/kubernetes/pki/etcd/server.crt \
   --key=/etc/kubernetes/pki/etcd/server.key  \
   get /registry/secrets/default/secretk8s | hexdump -C

The output will look like this output

So we can see a few things from here we can see the k8s:enc referenced to our provider we identified to encrypt our data aegscm and the output is showing that the encryption is applied.

kubectl get secret secretk8s -n default -o yaml

So now we can get the data but using the Kube API Server its not exposed via the ETCDCTL since we are running encryption at rest. Next let’s apply it to the rest of the cluster with the command below.

kubectl get secrets --all-namespaces -o json | kubectl replace -f -

How to encrypt secret data at rest in Kubernetes

Kubernetes provides multiple ways to encrypt secret data at rest. One way is to use an encryption key, which can be generated with the help of the kube-encryption-key command. This key can then be used to encrypt secret data in a secrets file or a configuration file. Encrypting secret data with the help of a secrets file.

Another way to encrypt secret data at rest in Kubernetes is to use a secrets file. This file can be created with the help of the kube-secrets command. The secrets file can then be used to encrypt secret data in a configuration file. Encrypting secret data with the help of a configuration file. Now you know one way to address this moving forward highly consider how you will move credentials as this is typically a choke point if not thought out.

The final way to encrypt secret data at rest in Kubernetes is to use a configuration file. This file can be created with the help of the kube-config command. The configuration file can then be used to encrypt secret data in a secrets file or an encryption key.

How to rotate encryption keys for data encryption at rest in Kubernetes.

As with any security measure, it is important to regularly rotate encryption keys to reduce the risk of data breaches. By rotating encryption keys, you can ensure that even if one key is compromised, your data will remain safe. There are a few reasons why you should rotate encryption keys:

To prevent attackers from using stolen or leaked keys to access your data: If an attacker gets their hands on one of your encryption keys, they could use it to decrypt your data. By regularly rotating your keys, you can make it more difficult for attackers to decrypt your data even if they have a key.

To prevent cryptographic vulnerabilities: Over time, cryptographic algorithms and implementations can become vulnerable to attack. By regularly rotating your encryption keys, you can ensure that even if one key becomes compromised, your data will remain safe.

To ensure that employees with access to encryption keys don’t become a security risk: Employees with access to encryption keys may pose a security risk if they leave the company or are compromised by attackers. By regularly rotating your encryption keys, you can limit the amount of time an employee has access to sensitive data.

How to rotate encryption keys.

There are a few different ways that you can rotate encryption keys in Kubernetes:

1) Use a key management system: A key management system (KMS) can help you generate and manage encryption keys. Using a KMS can help you rotate keys easily and securely. Many cloud providers offer KMS services that you can use to manage keys for Kubernetes resources. For example, Google Cloud offers Cloud KMS, AWS offers AWS Key Management Service (KMS), and Azure offers Azure Key Vault.

2) Manually generate new keys: You can also generate new keys manually using the OpenSSL toolkit. This approach requires more work than using a KMS but can be useful if you don’t want to use a cloud provider’s KMS service.

3) Use third-party tools: There are also several open source tools that can help you manageencryptionkeys for Kubernetes resources. For example, the kubesec project provides command-line tools for generating and managingencryptionkeys for Kubernetes resources.

Whichever approach you choose, make sure to carefully manage your encryption keys and keep them safe.

Conclusion

Data encryption at rest is a process of encoding data that is stored on a computer or other storage devices. This is done to protect the information from unauthorized access. There are many benefits to encrypting data at rest, including increased security and privacy, reduced risk of data breaches, and compliance with regulations. However, there are also some challenges associated with data encryption at rest, such as managing encryption keys and ensuring that data is properly encrypted when it is stored.

There are various methods that can be used to encrypt secret data at rest in Kubernetes. One option is to use an encryption key; another option is to use a secrets file; and yet another option is to use a configuration file. It is important to rotate encryption keys on a regular basis in order to ensure the security of the data. When rotating keys, it is important to take care to ensure that all data remains properly encrypted and that no keys are lost or forgotten.