Senior LevelDocker & Deployment
How do you enable Envelope Encryption for Kubernetes Secrets at rest using AWS KMS or HashiCorp Vault?
❓ Interview Prompt: Explain Kubernetes EncryptionConfiguration, envelope encryption (DEK/KEK model), KMS provider plugins, and AES-CBC vs AES-GCM tradeoffs.
By default, Kubernetes Secrets are stored in etcd as Base64-encoded plaintext — not encrypted. Anyone with etcd access (admin, backup files, etcd snapshots) can read all secrets.
Encryption at Rest Options (weakest → strongest):
1
`identity`: No encryption (default) — plaintext Base64 in etcd.
2
`aesgcm` / `aescbc`: Kubernetes encrypts Secrets with a static AES key stored in the EncryptionConfig file on the API server. Better, but the key is still on the same server.
3
KMS Envelope Encryption: Best practice — uses an external KMS (AWS KMS, HashiCorp Vault, Azure Key Vault).
Envelope Encryption (DEK/KEK Model):
1
Data Encryption Key (DEK): A unique AES key generated per Secret by Kubernetes.
2
The DEK encrypts the Secret data.
3
The DEK itself is encrypted by the Key Encryption Key (KEK) in the external KMS.
4
Only the encrypted DEK is stored in etcd alongside the encrypted Secret.
5
KEK never leaves KMS — Kubernetes only sees encrypted DEKs.
Benefits:
•
Compromise of etcd yields only encrypted blobs — useless without KMS access.
•
Key rotation: rotate KEK in KMS → re-encrypt DEKs without touching etcd.
•
Full audit trail in KMS for every decrypt operation.
Code Implementation Example
yaml
# /etc/kubernetes/encryption-config.yaml (on API server)
# EncryptionConfiguration: AWS KMS provider
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets # encrypt all Secret objects
- configmaps # optionally encrypt ConfigMaps too
providers:
# Primary: AWS KMS envelope encryption
- kms:
apiVersion: v2 # kms v2 = async, better performance
name: aws-kms
endpoint: unix:///var/run/kmsplugin/socket.sock # KMS plugin socket
cachesize: 1000 # cache decrypted DEKs for performance
timeout: 3s # timeout for KMS operations
# Fallback: identity (for reading pre-encrypted legacy secrets)
- identity: {}
# Note: The KMS plugin daemon (e.g., aws-encryption-provider) must run on
# each control plane node and communicate with AWS KMS:
# --key-id=arn:aws:kms:us-east-1:123456:key/mrk-abc123
# Verify encryption is working:
# etcdctl get /registry/secrets/default/mysecret | xxd
# Should show encrypted binary data, NOT plaintext💡EncryptionConfiguration using KMS v2 provider: Secrets encrypted with DEK, DEK encrypted by KEK in AWS KMS — KEK never leaves KMS.
🎯 Interview Key Takeaway
Kubernetes Secrets are Base64 by default — not encrypted! Enable KMS envelope encryption (DEK/KEK model): etcd stores encrypted ciphertext, KEK never leaves the external KMS service.
#Kubernetes#Secret Encryption#KMS#Envelope Encryption#Security#Senior
Back to all Docker & Deployment Questions→