security config_error ai_generated partial

Kubernetes secret is stored in plaintext in etcd

ID: security/kubernetes-secret-etcd-plaintext

Also available as: JSON · Markdown · 中文
80%Fix Rate
86%Confidence
1Evidence
2023-05-22First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Kubernetes 1.24 active — — —
Kubernetes 1.28 active — — —
etcd 3.5 active — — —

Root Cause

Kubernetes secrets are base64-encoded but not encrypted at rest in etcd unless encryption at rest is configured, exposing sensitive data to anyone with etcd access.

generic

中文

Kubernetes 密钥是 base64 编码的，但除非配置了静态加密，否则在 etcd 中不会加密存储，任何有权访问 etcd 的人都会暴露敏感数据。

Official Documentation

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/

Workarounds

  1. 85% success Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`. 
    Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`.
  2. 90% success Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd. 
    Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd.
  3. 60% success Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections. 
    Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections.

中文步骤

  1. 为 Kubernetes 密钥启用静态加密。编辑 kube-apiserver 配置，添加包含 `aescbc` 等提供程序的 EncryptionConfiguration 文件。示例：`--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`。
  2. 使用外部密钥管理系统，如 HashiCorp Vault 或 AWS Secrets Manager，并在应用程序中引用它们，而不是将密钥存储在 etcd 中。
  3. 将 etcd 访问限制为仅控制平面节点，并对所有 etcd 连接使用 TLS 客户端认证。

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Setting base64 encoding as encryption is a common misconception; base64 is not encryption and can be trivially decoded.

  2. 50% fail

    Using network policies to restrict etcd access doesn't protect against attackers who compromise a pod with etcd access.

  3. 70% fail

    Deleting the secret from etcd without cleaning up backups leaves the plaintext data in backup snapshots.