Cloud Native Computing Foundation GitOpsCon NA 2022, 28 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: How to Keep a Secret in GitOps, Without Keeping... - Nikita Kutselev & Daniel Hoang

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: How to Keep a Secret in GitOps, Without Keeping It in Git - Nikita Kutselev & Daniel Hoang, Akuity Inc

One of the biggest challenges to adopting GitOps is determining what strategy to use for secrets management.
In this session we will comprehensively compare 6 different tools that you can use to manage secrets in GitOps without violating the GitOps principles:
Sealed Secrets
Argo CD Vault Plugin
SOPS
Vault Agent
Secrets Store CSI Driver
External Secrets Operator
Afterwards we will share our experience evaluating these solutions, and why we chose External Secrets as the standard for our cloud infrastructure.

A

Hello, hello, yeah, so yeah, let's, let's introduce yourself um I'm solution, architect from architecture and.

B

I'm Daniel Hong I'm a developer Advocate at qut, okay,.

A

So initially it's supposed to be 40 minutes talk with a demo q, a and detailed explanation of each store, but don't.

C

Only have 10 minutes, we only have 10 minutes so.

A

Okay, not the water. We just squeeze all this 15 slides into one yeah here.

B

It is, we did I. Actually uh we strategically had Nikita talking too, because he talks faster than me. So, let's hop into it. So the.

A

Conclusion of our talk is use external Secrets operator and don't forget about passwordless Authentication. It is important. This solution covers. Like all most of the use cases, it's a reliable fence is secure. So this is our talk. Thank you very much.

A

Okay, like subscribe, follow Daniel of his Twitter. Wait.

B

Wait Nikita. It feels kind of wrong to just hop to a conclusion. Without you know, talking about all the potential solutions that we can use for Secrets managers and we still have quite a few a lot.

C

Of times so, let's.

B

uh I think we should explain it.

C

A little bit, okay,.

A

I mean let's: let's go fast fast uh for space, so first solution.

C

A

Or two parts uh first part skip Shield commento, you encrypt your secrets with Commando and second part is uh scene secret controller. Your decrypt uh stuff is still secret controller. That's that's! Basically it that's not rocket science. You encrypt there decrypt decrypt decrypt here, uh uh so it uses custom resources. So you need to install crgs in your cluster and so yeah. If we had time we could talk about uh the chicken neck problem and why you need the password to access your other passwords and where to keep the first password.

A

We also could talk about uh decryption key uh league. So if you, if your key some somehow is compromised, basically all your secret compromise too, oh- and you wouldn't have known about.

C

About this so yeah, but we don't have that much.

B

Time so I think a good conclusion for sealed Secrets is that it's a great tool for quick, starts or pocs. However, if you're considering for like Enterprise and production use cases, it might not scale as well.

A

So, okay, let's go next door next door.

C

A

Different uh it instead of encrypting your secrets, it needs. It requires some external uh secret storage and initial. It was Russia Corp board, but later they added support for other Cloud providers, so everything happens in rgc genome space when rgcg renders your Manifest. This plugin replaces some placeholders in your files, with uh with a secret panelists and like our Google, is not real githubs, because what you have in git and what you have in your environment is is not the same, and also it works only with rgcg.

A

If you try Cube Ctrl, it wouldn't work uh the same way.

C

B

What's a what's a flaw with this: oh.

A

Yeah uh I forgot uh like it's not, maybe it's not the bug as a feature. Your application one can easily easily get application to Secrets. Oh so yeah, if you, if you trust only developers, you can use it, but uh I don't know if.

B

Yeah so I think a good conclusion is that you know it supports a lot of you know: Secrets managers. However, uh it has that flaw. You can't really scope that down to specific pieces. So uh it's in our opinion, not a great choice for Enterprise use cases. Unless you can trust all of your developers which do we do we do that. Okay,.

C

A

Go next so soaps or secret Inspirations. It's kind of combination of two previous Stones, you encrypt secrets with a common line tool and your decrypt secrets with Argosy player. So it has weaknesses from both previous Stones. It's kind of soft the chicken neck problem with key store so and.

B

Key stores are different from Secrets managers. So, let's, let's not confuse them with each.

A

Other yeah keystore is not the same as secret measure unless it's Azure in Azure, it's the same, but in other products it's not the same uh whatever.

A

So it has the so many issues. Actually, we don't have to have to discuss everything the same same issue with application. One accession application, two Secrets, uh if you with uh really keys so on your secrets, are compromised.

B

Yeah I mean, let's close it yeah yeah. We can move past that we don't have time for that, but uh the gist here is that it's, uh it's still quite a popular tool because uh for legacy reasons typically like a lot of people are just still stuck using key stores secrets. Managers are a lot more flexible and it's more the path towards the future. So that's you know. It's also a lot of use cases where it's just hard to justify like moving to a new tool.

A

Let's go next, so next is a volunt agent injector, so it doesn't use any of that kubernetes fancy stuff. It's just good old agent uh process injected in each of your pod, and if you know, if you're familiar with Vault agent, you know that it connects to Vault server and updates uh your files in low compound.

B

System, so does that mean if you have a thousand pods, you would need a thousand additional processes running and making connections.

A

Yeah I mean yeah. If you have thousand pods and thousand connections your your server excellent might not like it, and if your server is down or basically all your ports cannot start. So it's one over. If we cut that, if we had time, we could talk about that particular very specific use case when, where it actually makes sense or to use this solution right.

B

Yeah I think the conclusion here is: you know you might run into a lot of scalability issues based on how this method works and, typically, uh if you're, considering using this you're, probably already using Vault and if you're not you're, probably already considering other solutions to begin with.

A

Okay, secret Source, CSI uh I forgot what CSI stands for us: continuous storage interface right, that's right! Oh okay! uh So it's a special type of driver or it mounts or it it runs on Port creation. So when the port is created, this driver mounts uh files into your port and optionally can create a secret kubernetes secret. But it's it's it's a it's! A storage driver so uh and it only works with storage.

A

So it doesn't seem to have that problem when application one can access application too Secrets, because it uses secret provider class and you can specify uh different secret provided classes. uh If we had time, we could talk about why it's demon said, and, unlike all other Solutions but I mean we don't have time right.

B

Yeah I think it's a valid solution. If you don't want to use kubernetes secrets- and you just want to mount files directly to your file system.

A

Oh okay, I'm lost, but.

B

A

External secret separator: uh okay: what do we have about external sequence? It doesn't seem to have all these issues from other terms that we didn't have time to talk about uh it.

A

It it uses custom resources just since, like seeing Secrets, but in this custom resources you keep coordinates of your secrets and it can use different secret stores. So it doesn't have this application. One accession application, two secrets: you can create different uh account for every application and different roles.

A

I mean. If we have time we can, we can talk about uh templating.

C

A

The secrets we could talk about or updating your secrets or and why sometimes you need to restart your post at some times.

C

It's not required it's very easy to set up tools.

A

Yeah and it's it's really a comprehensive, comprehensible and easy to set up I set up, like literally in seconds.

B

Yeah I think in conclusion, this is, you know, based on our research, it's an easy way to get started, it's easy to get up and started, and then it also scales very well. So it's very great for Enterprise use cases so.

A

The conclusion stays the same: yeah check out our booth uh YouTube down on the first floor right, yeah.

B

A

B

Can check out our booth we're going to.

A

B

At cubecon on the main conference days as well, and you can bother Nikita for any uh specific Secrets questions right.

A

Yeah I think that's it all right. Thank you.