Okay. So in this video we're going to look into encrypting secret
data address. So if you go to the kubernetes documentation
pages and under tasks you have administrator cluster
and encrypting secret data at rest.
You have these following.
Documents I'm going to follow this but also kind of
try and explain what we're trying to do. So the first
thing first thing first, I'm going to start up
a kubernetes playground.
So this is a single node cluster.
right, so
This basically uses is built with the qbarium
tool and has container D. I'm just going to maximize this
and we'll just work on the terminal. All
right. So the first thing's first I'm going to first create a
sacred object. So
I'm going to do a cable.
Create Secret.
And I want a generic secrets so do that.
and I'll probably
create a secret from literals. I'm just going to copy this
command.
Okay, I'm gonna probably P1 and super secret.
So that's my secret object. So my
secret object is created. So if I now do get secret
I get to see my secret object and if I do it describe.
great Secret
you get to see that it's the the secret
name and the data if I want to see a little bit more do a
Chevrolet ammo and I'm gonna do a get secret.
Okay, and I get
to see.
The data here now if you look here, so this
is key one and this is kind of
the encoded format of the secret.
So remember that, you know anyone could take this n decoded
and easily view the actual.
Secret right. So if I do
Let's see if I have a 64.
Yep, I do so.
Going to get that again. So I'm going to do a echo.
copy and paste this
pass it through basics for Android
and I get to see the the secret. Okay, so so that's
the first thing to know that the secrets objects
stored in the secret configuration as
you see it here is just base 64 encoded.
So if you just do a base 64 decode you're
gonna see the so remember not to create your secret
definition files and you know, push it to GitHub or
something because anyone could just pick this up and run this command and
see the secret right? So that's the first step but I want
to make it clear that this the scope of this video is not really relevant to
this and encoding here.
We are going to focus on the data that
stored within the at CD server.
Okay. So this after we
are done this part is still going to be still going
to remain the same. So we're not really focusing on this part right
here. What we're focusing on is how
the data is stored in the hcd server.
So that's the focus.
So let's first look at how this data is stored in the hcd
server.
Okay, so for that if you go to the
bottom of this there is this command
and it's uses the HD color API version
3. It runs the city cuddle command passing the
Cs certificates for authentication and we're going to get this particular
secret. So
The way that is stored in its a day is stored in
registry and secrets and default and this is the secret name. So let
me first see if we have the HD cuddle
command line so we don't have that. So the first
step is to get that installed. So I'm just going to do it if you
can install.
I think it's it's CD find.
Yeah, so if you do not have the hcd.
On so so remember that the Etsy
server is running in a pod so you can either SSH into
the exact into the pot and then runs it CD cuddle
command from within that or if you're you want to write locally from
your control plane node, you could use the LCD cuddle
client. Usually now if the client command line
utility is not available you have different options
to install it on different systems. So,
let's see.
Okay, so I have it installed on my machine using the
HD the package STD
client. So look up for whatever it
is that your the version
of that City that you're running.
Okay, so that's there. So now we've got it City cuddle utility. So that's
remember that's the client only the server still running on.
As a part, so if you'll get thoughts -
Cube system.
I have
The STD control plane here, right?
Okay, so the next step is to run this
so first remember that you need the the
certificate file. So, let's see if we have that.
Yeah, we do. So under the under hcd you have all the
certificates files needed for it for connecting or authenticating
to the city server. So that's good. So I'm gonna
copy this command remember to set the version at
City cuddle API version to 3 and the name
of the secret is secret one.
See what I created.
It's secrets.
So it's named my secrets. I'm gonna replace that with my
secret. We'll do my secret. If I
just run this command, you can see that it kind of gives me
a kind of a jumbled information, but you
can kind of see the secret there as is
right. You can see the secret there in the
text format to see it in this format. You just
need to append.
The hex dumped to it.
Because sometimes you may not be able to see it.
In the right format. So this is the data that's stored in a CD
and if you look closely you'll see that the the secret
that I have the password or whatever it is that I've stored
is actually visible like this. So the data
is stored in a CD in
a an unencrypted format. So anyone with access to
hcd will be able to just go through and get all the secret secrets
and other confidential information stored as a
secret object.
So that's that's the problem here. So this is the problem that we are trying to solve by
enabling encryption at rest in NCD.
now if you go through this document
first thing that it says is first we
need to determine if encryption address is already enabled or
not. So this is done with the property called encryption provider
config. So if I go to
Thank you, very server. So let's say my QPS service running as
a process here.
And let me just grab for cube API server
and I get to see the queen APS server.
Process running with all the options. Let's first
see if it has the encryption provider.
Config option. So that's the first thing that we'll do.
This is to check if I can encryption at rest is already
enabled and as you can see it does not return a result. So that
means this option is not configured you can we can also kind of
verify this because this is a cube ADM setup.
It uses the
War
manifest
Okay, see.
Kubernetes manifest yeah, it is a kubernetes
manifest and here you have the cube APS
server. So if configuration, so if you look at
this particular file
into a cat
we'll be able to see all the options provided and here you don't
see the
encryption option
that we have talked about here. So this means that encryption address is
not not enabled. So that's the first step and we've already verified that
by creating the secret subject. Okay.
So the next step is to create a configuration
file and then pass it in as this particular
option. So that's it. So that's basically the steps required to
enable encryption press you create a configuration file and
you pass it in as an option.
So let's look at the configuration file. So this is what it is. So you have
the APA version you have the kind is encryption configuration. And
then you have resources now you can pick and choose
which resources you want to encrypt right? So
you have pause deployments and secrets and
services. You want to store all
of them as encrypted. You might not because not everything
is confidential right? So you need not
necessarily encrypt and save all the data about parts
and and deployment here are concern
is just secret so under resources you specify the
target. So this is secrets. That means only the secret objects are going
to be encrypted. Now, you can
encrypt something using a set
of providers, right? So the default one is called identity and
the identity provider just means that there's no
encryption at all. So you can see the list of providers here and it
says the identity to provide to say, there's no encryption resources are
rich and essays without any encryption.
So and then you have other providers which are
these and those are listed here. So you have the secret box you have
the AES GCM the as
CBC so CBC, so all of these are encryption algorithms
different encryption algorithms and you can see the details
about how they are.
how they encrypt here
so you can choose whichever one you want and provide
a key. So this key has a
secret you can provide multiple keys keys and
secrets and this secret is what will be
used to use for the encryption by the encryption algorithm
right now.
One thing to note here is the order. So this as you
can see providers is a list. So these this is the first item in
the list second item in the list third item and the reason for the
item in the list. So this order matters because when
When the encryption happens it first,
it uses this to encrypt and then
it could use any of these to decrypt right? So
always encryption happens with
this. So if identity provider, which is a pro,
which has no encryption is the first one
then there's no encryption enable at all.
So that's how that's how it works. So if this is the first
one that means this is what is you going to be used for encryption and
since it's identity it's not going to encrypt anything
at all. So if we if you really want
to encrypt
The data and SED then one of these should be
at the top. Okay, so that's that's then that's
the whatever is the first one is what's going to be used for
encryption.
So let's just do this real quick. So we're
going to create a very simple version of this
file, which is
Which is this and this as you can see, we have specified that
all the secrets are going to be encrypted and we're going to use the AES
CBC encryption provider
and you as you can see identities at the bottom. So the first one
is a CVC. So this is what is going to be used for encryption. Now
this requires a secret.
Object so we could generate a 32 by random key using this
using this. I'm just gonna
copy this
and get that key first. So this that's what our key
is going to be. Then I'm going to copy this and create encryption
object file. So I'll
call it PNC dot ammo.
And I'm going to paste this.
Okay should have copied the secret.
Value first I'm going to copy this.
And I'm going to go here and replace.
the secret object here
Okay.
Okay, so that's that. So now I have the encryption configuration
file. It's currently in my
home directory now. All I need to do is
go and
edit this file. So that's the next step shown
here. So.
In the cube API server. I'm going to add this line to point
to the encryption file that is just created then
of course we need to since the file
is created locally. I have to mount it inside. So I'm going to use volumes and
volume mounts. If you have not gone through the volumes
and volume months yet. Then you might want to take a
look at that and come back but this is
pretty straightforward. So here you have the directory
the local directory and that's on my
on my mission on my control panel node here
and this directory is going to be mapped to this path
within the Pod and then so anything
that's available here is going to be available here. That's it.
So first I'm gonna
create this local directory so they can put my
file there.
And move my encryption file from
here.
to local directory
make sure
yep, so I have the file there now.
So now I'm going to edit the cube API server manifest file and then
make this changes. Okay, so that's next step. So
I'm gonna go into
It is.
manifest and Cube API server
and the first thing that I'm going to do
I'm going to add.
this line
so this
Is what tells where the encryption configuration file
is? So that's the first step and I'm going to go down.
So I have two things I have volume mounts. So this is inside
my volume inside the
pod.
Where is going to be mounted so I'm going to copy this.
So the directory the local directory is going
to be mounted into this path. So that's the first
step then below under mount. I'm going to
specify
the location of my local directory
Okay. So this is how it works on my
local host the Etsy kubernetes. ENC directory is
going to be mapped.
to
the HTC kubernetes Inc directory
inside the pod
and then
so since my enc.aml file is available
locally that file is going to be available inside and that's it.
Okay, save that.
So now that I've saved image changes to this file the QB
APS ever should be restarting. So let's just give it
a few seconds. Let's see. Okay, so this is
now
It's now gone, so I'm going to wait.
For it to come back.
waiting and if you want to see the
status of the qbps server since we're using
container so you could use a try cuddle command.
You could do the Cricut pause to see.
Just come up. Okay, so it looks like it's ready three seconds ago.
I'm just gonna do. Yep, so it's back.
Okay, so now let's do
a psax and grab for you. Yes
server.
And let's see if it has just to confirm if
it has the encryption.
Yeah, so it looks like it has the encryption provider configured. Okay,
so that's that's good. Now what
we're going to do is
going to create another.
Secrets file
So we're going to create a secret object. So we're going to create
cute color create Secret.
in Eric
okay, and we are going to
say pick this
and this time we'll just create the second one, which is key to
To have key to and it's called the values
top secret.
We create that.
My secret already exists. I'm gonna say my secret
to
maybe yep.
Okay, so I now have two there's the
first one I created. This is the second one. I just created after encryption was
enabled. So I'm going to go and run the
same command as I did previously to check
the status of
that within a city so
this
and the name is my favorite, too.
and
Okay, and as you can see I can
no longer see.
The top secrets of the value of top secret and I don't I no longer see
that here. That means encryption is enabled.
Okay, and if I do the same
for the old one?
I still see the super secret now. This is because
After encryption is enabled only things that
you create newly will be.
Will be encrypted everything that exists previously won't be
re-encrypted. But if you update an
existing configuration, then that will be re-encrypted. So
one of the things that you have here is to ensure all
secrets are encrypted. So to and what
this is doing is basically you're getting getting the secrets and then just re
replacing them with the same Json file. So
essentially you're just updating and
the objects with the same data.
So I'm just gonna do that. So that's done. And if
I run the same command again, I see that it's no longer sees the
super super secret.
All right, so that's basically encrypting secret data
at rest.
Using one of these encryption algorithms right? Thank you
very much, and I'll see you in the next one.