11.3. Secrets Management and Encryption
Secrets — database passwords, API keys, private keys — are the credentials that turn one breach into total compromise, and the hardest problem in managing them is bootstrap: the secret that unlocks the other secrets has to come from somewhere. This chapter covers dynamic secrets and rotation with Vault, why Kubernetes Secrets alone are insufficient, envelope encryption that lets you rotate keys without re-encrypting data, the transit-versus-at-rest encryption both of which are mandatory, and supply-chain security that verifies your artifacts were not tampered with before they ran.
Topics Covered
Section titled “Topics Covered”- 11.3.1. HashiCorp Vault: Dynamic Secrets, Leases, and Rotation: Covers Vault’s dynamic secrets, leases, and rotation that replace long-lived static credentials.
- 11.3.2. Kubernetes Secrets: Why They Are Not Enough: Explains why Kubernetes Secrets alone are insufficient, being only base64-encoded by default.
- 11.3.3. Envelope Encryption: The Key Encryption Key (KEK) Model: Covers envelope encryption and the key-encryption-key model that lets you rotate keys without re-encrypting data.
- 11.3.4. Encryption in Transit vs. At Rest: Both Are Mandatory: Explains why both in-transit and at-rest encryption are mandatory and what each protects against.
- 11.3.5. Supply Chain Security: The SLSA Framework and Sigstore: Covers supply-chain security with the SLSA framework and Sigstore for verifiable artifact provenance.