Cloud Native Computing Foundation GitOpsCon EU 2022, 19 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Hiding in Plain Sight - How Flux Decrypts Secrets - Somtochi Onyekwere, Weaveworks

Description

Lightning Talk: Hiding in Plain Sight - How Flux Decrypts Secrets - Somtochi Onyekwere, Weaveworks

GitOps has been all the rage of late and it requires you to store all your YAML files in Git. This works great for YAMLs containing non-sensitive information but it gets trickier for files that contain secrets even if the repository is secret. Anyone who has or gains access to your repository can access your secret, which could include database passwords and API keys. This talk explores how Flux, with the help of projects such as Mozilla SOPS and sealed secrets, lets you encrypt your secrets and then store them as files in Git. Then, it decrypts them for you and applies them to the cluster. Flux also lets you use key management systems (KMS) in the major cloud providers so you don’t have to create the secret containing your private key in the cluster. The talk will end with a showcase of this feature in Flux using live demos and practical examples. These tools and techniques will help users to benefit from GitOps with the added security that Flux brings.

A

Hello, everyone and welcome to my talk, welcome to github's con and shout out to the organizers of this conference for the opportunity to speak. Title of my talk is hiding in plain sight is mostly around how flux lets you store your sensitive credentials in gitz. My name is oniyakuri suntochi a little about myself.

A

I'm a developer, experienced engineer at weave works where I work mostly on flux, I'm a maintainer of the notification controller projects.

A

You can connect with me on twitter at sumtochi ama, so just a quick refresher for people who are just hearing about flux or github for the first time this is github's con. So I'm sure you have more talks. You know delving deep into it. Githubs is an operations methodology.

A

It's a way of deploying your applications and infrastructure where the entire system is described, declaratively just like with kubernetes and is manifest, and this declarative manifest is stored in a version controlled system such as gits and flux sits at number four, you know software agents, initial current correctness and reconcile on divergence.

A

It's flux is a set of controllers that sits on your cluster. It pulls your defined declarative state from git and then applies it on the cluster and periodically reconciles it to ensure that what you defined in gates matches the state on the cluster. So it applies your deployments. Your service accounts other resources, which include secrets.

A

So you want to detox everything. Github brings a lot of business value. It's you know increased velocities, you know developers can focus on developing and makes it easy for the infrastructure team to set up it gives repeatability, and we also want to do this for secrets right. There's benefits to managing secrets with githubs. It gives increased security.

A

Any changes to your secrets, whether accidental or malicious. uh You can be sure that they are. They are going to be reverted within a reasonable time frame. I don't know if anyone has ever deleted. You know a secret on a production cluster. You know if a secret gets deleted, it's going to be recreated.

A

It also gives you an audit log since there's a version controlled history of every change to the file and you can put in an approval process so that, before any change, changes are made. You know someone from a particular team has to approve, etc, etc. So all of this is great right, but how do we store these files in git since they contain sensitive information right? You don't want just the contain. Maybe passwords database connections usernames whatever it might be configuration files.

A

You don't just want anyone who has access to. You know your repository to be able to have access to the secrets yeah. So the of the answer is to encrypt enlists, the help of two projects, um mozilla soaps and sealed secrets from vietnamese labs.

A

This is the above open source project. This is an example of a collaboration across projects in the open source piece. So for sealed, secret seal secrets has a dedicated controller that runs outside of phlox. That is used to decrypt secrets and it has a cube seal acli called cube seal that is used to increase the secret. So everything is cube. Seal manages the secrets, it creates the secret. You know encrypts and defeat everything just happens on you, you'd have to deploy it into your cluster. It doesn't come, you know, packaged in with flux.

A

You would have to deploy it so if you're already using cubesale. This is like a very handy solution, so you would use the cube c cli to encrypt your sensitive file. Your secrets, cubesat, this cube cocli, will include the encrypted data in the sealed secret custom resource.

A

The keepsail controller recognizes this resource and when you push this file to bids on its next run, flux pulls it and applies it on the cluster. It creates the sealed secret custom resource, then the seal controller notices the custom resource and then acts on it. You know decrypts and then applies the secrets in the cluster.

A

So that's basically the flow. You know you encrypt using the keeps you cli and this produces a custom resource file. It pushes to beats plugs pulls. The file applies it on the cluster and then the cubesale controller sees the custom resource decrypts it and then applies it to the secrets.

A

So mozilla subs is also another project. My um clock uses the mozilla subs library, so you know it comes automatically refluxed and substitutes. Open source technologies such as open, pgp and age age, is the modern. You know profile solution for encryption, so with this um it also integrates with various call providers like gcp kms, azure key volts. You know hashicorp volts so, but with with openpg, openpdp and age, you can pick your key format. You know that doesn't get. It's keeps you. You don't get to pick your key format or everything keeps you.

A

You know makes that decision for you, because it does everything on its own. You can pick you can specify your key format. You know you provide sub to the key and then it decrypts it for you and it encrypts the file for you. So you would tell subs to only encrypt the data field, because um flux would requires you to only encrypt the data field. You'd encrypt the data field with stop seller. You know passing in the required flight flag, you know.

A

If it's gpg, you need to pgp, you need to pass in the fingerprints with gcp kms. You know the resource id. You would specify the correct flag and also tell sops to only encrypt a particular. You could give it a reject, so it only encrypts particular fields when soft has encrypted the file you push it to git.

A

Now flux would pull the encrypted the file with parts of it encrypted. It's um beforehand. You specify in the customized custom resource that you know you're using flux to encrypt the secrets, so flux will check the file and if it's encrypted with subs, it will decrypt it using the soft library and then apply apply. The this will produce after decryption apply the secrets on the cluster. So this is one way. This is another way that flux makes you store. You know your secrets encrypted in in your gauge repository.

A

So yes, just there's three steps here. We encrypt push to git, you know normally increase decrypts, but because we are using github. Yes, we push the bits first and half flocks pull the file and it had decrypted itself if you're using sops or you know the keeps your controller if you're using sealed secrets. So that's the three major step, so I've tried to keep it short and sweet because the lightning talk I'm trying to stick to 10 minutes.

A

If you need for our guide like we have dogs on on both of them, so you could take a look at the links, so also, please do stop by at flux boots we're always looking forward to meeting new people interested in vlogs or looking to know what we're up about. You know, there's the vlogs booked online and there's one in cubecon.

A

Thank you for 10 minutes of your time. You can connect with me on twitter and github at somtuchi ama. Thank you.