Skip to content

Commit 0e0e66c

Browse files
MichaelCadeMichaelCade
committed
Finally added Day 40 and 41 for the 2023 Edition
1 parent a3d3592 commit 0e0e66c

2 files changed

Lines changed: 219 additions & 0 deletions

File tree

‎2023/day40.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Understanding Kubernetes Secrets
2+
## Introduction
3+
4+
Kubernetes has become the de facto standard for container orchestration, enabling developers to deploy, manage, and scale applications with ease. As you manage applications on Kubernetes, you'll often need to handle sensitive information like passwords, tokens, and keys. This is where Kubernetes secrets come into play. In this post, we'll explore what Kubernetes secrets are, why they are important, and how they work.
5+
6+
## What are Kubernetes Secrets?
7+
Kubernetes secrets are objects designed to store sensitive information securely. Unlike ConfigMaps, which store configuration data in plain text, secrets are intended to hold sensitive data, such as:
8+
9+
- Passwords
10+
- API tokens
11+
- SSH keys
12+
- TLS certificates
13+
14+
Secrets are encoded in Base64 format and can be used in various ways to ensure sensitive information is handled securely within your Kubernetes clusters.
15+
16+
## Types of Secrets:
17+
18+
- Opaque: The default secret type for arbitrary user-defined data.
19+
- TLS: Specifically used to store TLS certificates and keys.
20+
- Docker Config: Used for storing Docker registry credentials.
21+
- Basic Auth: Stores username and password pairs.
22+
- SSH Auth: Stores SSH keys.
23+
24+
## Why are Kubernetes Secrets Important?
25+
26+
Kubernetes secrets are crucial for several reasons:
27+
28+
1. Security and Confidentiality: Secrets help keep sensitive data out of application code and configuration files.
29+
2. Avoid Hardcoding: They prevent hardcoding sensitive information in your codebase, reducing the risk of leaks.
30+
3. Simplified Management: Secrets simplify the process of updating sensitive data without requiring application restarts or redeployments.
31+
32+
## How Kubernetes Secrets Work
33+
34+
Creation and Storage: Secrets can be created manually or programmatically using kubectl, the Kubernetes API, or Helm charts. They are stored in the etcd database, which should be configured to encrypt data at rest.
35+
36+
Accessing Secrets: Secrets can be mounted as volumes or exposed as environment variables within pods. This allows applications to access the sensitive information without exposing it in the container image.
37+
38+
Encryption at Rest: Kubernetes supports encryption at rest for secrets stored in etcd. This adds an extra layer of security by ensuring that the secret data is encrypted when written to disk.
39+
40+
## Conclusion
41+
42+
Kubernetes secrets are an essential component for securely managing sensitive information in your clusters. They provide a secure, flexible, and manageable way to handle data that should not be exposed or hardcoded. In the next post, we'll dive into hands-on scenarios to help you get started with creating and using Kubernetes secrets.
43+
44+
## Resources
45+
46+
# Free YouTube Resources for Kubernetes Secrets Management
47+
48+
1. **Kubernetes Secrets Explained**
49+
- [Kubernetes Secrets Explained | Kubernetes Tutorial 16 | Learn Kubernetes](https://www.youtube.com/watch?v=au6gC2iE2JM) by TechWorld with Nana
50+
- This video explains the basics of Kubernetes secrets, how to create them, and how to use them in your pods.
51+
52+
2. **Managing Secrets in Kubernetes**
53+
- [Managing Secrets in Kubernetes](https://www.youtube.com/watch?v=ON5pQByUkkE) by A Cloud Guru
54+
- This video covers different types of secrets, how to manage them, and best practices.
55+
56+
3. **Kubernetes Secrets: Store, Use & Encrypt Secrets with Kubernetes**
57+
- [Kubernetes Secrets: Store, Use & Encrypt Secrets with Kubernetes](https://www.youtube.com/watch?v=fFOvlPjuw9I) by DevOps Toolkit
58+
- The video dives into how to create secrets, access them from pods, and enable encryption at rest.
59+
60+
4. **Using Kubernetes Secrets**
61+
- [Using Kubernetes Secrets](https://www.youtube.com/watch?v=gZX9Vxjpo5Y) by IBM Technology
62+
- This tutorial explains how to create, manage, and use secrets in a Kubernetes cluster.
63+
64+
5. **Kubernetes Tutorial: How to use Kubernetes Secrets in your cluster**
65+
- [Kubernetes Tutorial: How to use Kubernetes Secrets in your cluster](https://www.youtube.com/watch?v=5fCJlAqC1B0) by Just me and Opensource
66+
- The video provides a hands-on guide to creating and using secrets in Kubernetes.
67+
68+
6. **Kubernetes Secrets Management Best Practices**
69+
- [Kubernetes Secrets Management Best Practices](https://www.youtube.com/watch?v=Nwd8tUP43WU) by Kubernetes Community Days
70+
- This talk focuses on best practices for managing secrets in Kubernetes environments.
71+
72+
7. **Kubernetes Secrets and ConfigMaps**
73+
- [Kubernetes Secrets and ConfigMaps](https://www.youtube.com/watch?v=7UXJ-nxW1EI) by FreeCodeCamp.org
74+
- This video covers the differences between ConfigMaps and Secrets and how to use both effectively.
75+
76+
8. **Kubernetes Secrets | Security and Configuration Management in Kubernetes**
77+
- [Kubernetes Secrets | Security and Configuration Management in Kubernetes](https://www.youtube.com/watch?v=twFRhEcvC2E) by Tech Primers
78+
- A comprehensive guide to security and configuration management using Kubernetes secrets.
79+
80+
9. **Advanced Kubernetes Secrets Management with HashiCorp Vault**
81+
- [Advanced Kubernetes Secrets Management with HashiCorp Vault](https://www.youtube.com/watch?v=byCCrbt0bBo) by HashiCorp
82+
- This video demonstrates how to integrate HashiCorp Vault with Kubernetes for advanced secrets management.
83+
84+
10. **Secrets Management in Kubernetes with Sealed Secrets**
85+
- [Secrets Management in Kubernetes with Sealed Secrets](https://www.youtube.com/watch?v=UrhZiFEYcs4) by KubeCon + CloudNativeCon
86+
- A presentation on how to manage secrets using Sealed Secrets, a tool that allows secrets to be safely stored and managed within Git repositories.
87+
88+
This wraps up Day 40, tomorrow we will get hands-on with Kubernetes secrets [Day 41](day41.md)

‎2023/day41.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Hands-On with Kubernetes Secrets
2+
3+
## Introduction
4+
5+
On [Day 40](day40.md) we gave an introduction to Kubernetes secrets after dabbling a little with them on [Day 39](day39.md)., we discussed the importance of Kubernetes secrets and how they help secure sensitive information. Now, let's get hands-on with some practical scenarios to demonstrate how you can create and use secrets in your Kubernetes environment.
6+
7+
## Scenario 1: Creating and Using a Simple Opaque Secret
8+
9+
For these scenarios we are going to need that minikube cluster again, You can see those instructions on [Day 39](day39.md) to get a cluster up and running.
10+
11+
### Step-by-Step Guide:
12+
13+
1. **Create a Secret:**
14+
```bash
15+
kubectl create secret generic my-secret --from-literal=username=myuser --from-literal=password=mypassword
16+
```
17+
18+
2. **Access the Secret in a Pod:**
19+
```yaml
20+
apiVersion: v1
21+
kind: Pod
22+
metadata:
23+
name: secret-test
24+
spec:
25+
containers:
26+
- name: mycontainer
27+
image: nginx
28+
env:
29+
- name: USERNAME
30+
valueFrom:
31+
secretKeyRef:
32+
name: my-secret
33+
key: username
34+
- name: PASSWORD
35+
valueFrom:
36+
secretKeyRef:
37+
name: my-secret
38+
key: password
39+
restartPolicy: Never
40+
```
41+
42+
3. **Deploy the Pod:**
43+
```bash
44+
kubectl apply -f secret-pod.yaml
45+
```
46+
47+
## Scenario 2: Using Secrets for TLS Certificates
48+
49+
### Step-by-Step Guide:
50+
51+
1. **Create a TLS Secret:**
52+
```bash
53+
kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key
54+
```
55+
56+
2. **Configure a Pod to Use the TLS Secret:**
57+
```yaml
58+
apiVersion: v1
59+
kind: Pod
60+
metadata:
61+
name: tls-pod
62+
spec:
63+
containers:
64+
- name: mycontainer
65+
image: nginx
66+
volumeMounts:
67+
- name: tls-volume
68+
mountPath: "/etc/nginx/ssl"
69+
readOnly: true
70+
volumes:
71+
- name: tls-volume
72+
secret:
73+
secretName: tls-secret
74+
restartPolicy: Never
75+
```
76+
77+
3. **Deploy the Pod:**
78+
```bash
79+
kubectl apply -f tls-pod.yaml
80+
```
81+
82+
## Scenario 3: Managing Secrets with Environment Variables
83+
84+
### Step-by-Step Guide:
85+
86+
1. **Create a Secret:**
87+
```bash
88+
kubectl create secret generic db-secret --from-literal=db_username=dbuser --from-literal=db_password=dbpass
89+
```
90+
91+
2. **Use the Secret as Environment Variables in a Pod:**
92+
```yaml
93+
apiVersion: v1
94+
kind: Pod
95+
metadata:
96+
name: env-pod
97+
spec:
98+
containers:
99+
- name: mycontainer
100+
image: mysql
101+
env:
102+
- name: DB_USERNAME
103+
valueFrom:
104+
secretKeyRef:
105+
name: db-secret
106+
key: db_username
107+
- name: DB_PASSWORD
108+
valueFrom:
109+
secretKeyRef:
110+
name: db-secret
111+
key: db_password
112+
restartPolicy: Never
113+
```
114+
115+
3. **Deploy the Pod:**
116+
```bash
117+
kubectl apply -f env-pod.yaml
118+
```
119+
120+
## Best Practices for Managing Kubernetes Secrets
121+
122+
1. **Regularly Rotate Secrets**: Change your secrets periodically to reduce the risk of compromise.
123+
2. **Use RBAC to Control Access**: Restrict access to secrets using Kubernetes Role-Based Access Control (RBAC).
124+
3. **Enable Encryption at Rest**: Ensure your etcd database is configured to encrypt secrets at rest for added security.
125+
126+
## Conclusion
127+
128+
In this post, we've explored practical scenarios for creating and using Kubernetes secrets. By following these steps, you can securely manage sensitive information in your Kubernetes clusters. Remember to follow best practices to keep your secrets safe and secure. Happy Kubernetes-ing!
129+
130+
131+
This wraps up the Secrets Management section, [Day 42](day42.md) We can get into into some programming language learning specifically around Python.

0 commit comments

Comments
 (0)