{"id":3491,"date":"2021-04-20T14:23:44","date_gmt":"2021-04-20T14:23:44","guid":{"rendered":"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/"},"modified":"2021-11-16T19:02:37","modified_gmt":"2021-11-16T19:02:37","slug":"securing-secrets-in-kubernetes","status":"publish","type":"post","link":"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/","title":{"rendered":"Securing Secrets in Kubernetes"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"3491\" class=\"elementor elementor-3491\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-67c25053 elementor-section-boxed elementor-section-height-default elementor-section-height-default qodef-elementor-content-no\" data-id=\"67c25053\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6625aaf5\" data-id=\"6625aaf5\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-60ea2ab elementor-widget elementor-widget-text-editor\" data-id=\"60ea2ab\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 25-04-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<header class=\"entry-header\"><h2><span style=\"font-size: 26px;\">Conjur Kubernetes Authentication: A Hands-On Demonstration<\/span><\/h2><div class=\"entry-meta\">\u00a0<span style=\"color: #00b2a9; font-size: 2rem;\">The Challenge<\/span><\/div><\/header><div class=\"entry-content\"><p><a href=\"https:\/\/www.conjur.org\/solutions\/secrets-management\/\">Secrets<\/a>\u00a0\u2013 or privileged credentials that act as \u201ckeys\u201d\u2013 are essential in\u00a0<a href=\"https:\/\/www.conjur.org\/use-cases\/kubernetes-security\/\">Kubernetes environments<\/a>. Kubernetes pods and their component containers need secrets to access protected resources like databases, SSH servers, and HTTPS services. Establishing a strong non-human identity is critical in securing secrets and the access they provide.<\/p><h3>Conjur:\u00a0An Open-Source Solution<\/h3><p><a href=\"https:\/\/www.conjur.org\/why-conjur\/\">Conjur<\/a>\u00a0is an open-source, centralized platform that\u00a0enables organizations to consistently enforce security policies for non-human identities for secrets management and access control. Conjur\u00a0helps\u00a0you\u00a0implement\u00a0best practices for\u00a0<a href=\"https:\/\/www.conjur.org\/solutions\/secrets-management\/\">secrets management<\/a>,\u00a0including:<\/p><ul style=\"font-size: 16px;\"><li style=\"font-size: 16px;\"><a href=\"https:\/\/www.conjur.org\/blog\/kubernetes-authentication\/\">Strong authentication<\/a><\/li><li style=\"font-size: 16px;\">Least privilege<\/li><li style=\"font-size: 16px;\">Security policy as code<\/li><li style=\"font-size: 16px;\"><a href=\"https:\/\/www.conjur.org\/solutions\/rbac\/\">Role-based access control (RBAC)<\/a><\/li><li style=\"font-size: 16px;\">Credential rotation<\/li><li style=\"font-size: 16px;\">Audit<\/li><\/ul><p>Conjur\u00a0is part of the\u00a0<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Overview\/Conjur-OSS-Suite-Overview.html?tocpath=_____1\">Conjur Open Source\u00a0Suite (OSS)<\/a>\u00a0collection of software components and tools.<\/p><p>In the sections that follow, we\u2019ll set up a\u00a0Conjur\u00a0cluster along with some application pods to demonstrate and explore\u00a0Conjur\u2019s\u00a0authentication mechanisms for\u00a0<a href=\"https:\/\/contentlab.com\/category\/kubernetes-and-docker\/\">Kubernetes<\/a>.<\/p><h3>Take it for a Spin<\/h3><p>Let\u2019s\u00a0first\u00a0set up a\u00a0running\u00a0Kubernetes\/Conjur\u00a0\u201csandbox\u201d that we can use to\u00a0explore\u00a0some of the concepts behind\u00a0<a href=\"https:\/\/www.conjur.org\/why-conjur\/\">Conjur<\/a>\u00a0and\u00a0<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Services\/k8s_auth.htm?tocpath=Fundamentals%7CAuthentication%7C_____8\">Conjur\u00a0Kubernetes Authentication<\/a>.<\/p><p>To\u00a0follow along, you will need one of the following:<\/p><ul style=\"font-size: 16px;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-aria-posinset=\"0\" data-aria-level=\"1\">MacOS laptop\u00a0running Docker Desktop<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-aria-posinset=\"0\" data-aria-level=\"1\">Linux workstation\u00a0or\u00a0VM running Docker<\/li><\/ul><p>You\u00a0don\u2019t have to have a\u00a0Kubernetes cluster available\u00a0before running\u00a0the demo. We\u2019ll use some automated scripts that are available\u00a0<a href=\"https:\/\/github.com\/cyberark\/conjur-oss-helm-chart\/tree\/master\/examples\/kubernetes-in-docker\">here<\/a>\u00a0that use\u00a0<a href=\"https:\/\/kind.sigs.k8s.io\/\">Kubernetes-in-Docker (KinD)<\/a>\u00a0to set up a local Kubernetes cluster, and then deploy\u00a0Conjur\u00a0and some applications in that local cluster.<\/p><h4>Step 1: Install\u00a0Prerequisite\u00a0Client Utilities<\/h4><p>The\u00a0Conjur\u00a0OSS demo scripts make use of several client binary utilities that will need to be installed on your system, if they\u2019re not already available:<\/p><ul style=\"font-size: 16px;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">Helm client:\u00a0<a href=\"https:\/\/helm.sh\/docs\/intro\/install\/\">https:\/\/helm.sh\/docs\/intro\/install\/<\/a><\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">\u2018kubectl\u2019 client:\u00a0<a href=\"https:\/\/kubernetes.io\/docs\/tasks\/tools\/install-kubectl\/\">https:\/\/kubernetes.io\/docs\/tasks\/tools\/install-kubectl\/<\/a><\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">Kubernetes-in-Docker \u2018kind\u2019 client:\u00a0<a href=\"https:\/\/kind.sigs.k8s.io\/docs\/user\/quick-start#installation\">https:\/\/kind.sigs.k8s.io\/docs\/user\/quick-start#installation<\/a><\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">\u2018git\u2019:\u00a0<a href=\"https:\/\/git-scm.com\/book\/en\/v2\/Getting-Started-Installing-Git\/\">https:\/\/git-scm.com\/book\/en\/v2\/Getting-Started-Installing-Git\/<\/a><\/li><\/ul><h4>Step 2: Clone the\u00a0Conjur OSS Helm Chart Repository<\/h4><p>Run the following to clone the\u00a0Conjur\u00a0OSS Helm Chart GitHub repository:<\/p><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69d1884 elementor-widget elementor-widget-code-highlight\" data-id=\"69d1884\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-git line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-git\">\n\t\t\t\t\t<xmp>mkdir -p ~\/cyberark\r\ncd ~\/cyberark\r\ngit clone https:\/\/github.com\/cyberark\/conjur-oss-helm-chart\r\ncd conjur-oss-helm-chart<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-db7d1d4 elementor-widget elementor-widget-text-editor\" data-id=\"db7d1d4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h4 style=\"font-family: Sailec, sans-serif;\">Step 3: Run the demo scripts<\/h4><p>Run the following\u00a0commands\u00a0to\u00a0deploy\u00a0the\u00a0<a href=\"https:\/\/github.com\/cyberark\/conjur-oss-helm-chart\/tree\/master\/examples\/kubernetes-in-docker\">Conjur\u00a0Kubernetes-in-Docker demo<\/a>:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3327da0 elementor-widget elementor-widget-code-highlight\" data-id=\"3327da0\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>cd examples\/kubernetes-in-docker\r\n.\/start<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0012e84 elementor-widget elementor-widget-text-editor\" data-id=\"0012e84\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>That\u2019s all there is to it!<\/p><p>If everything is successful, you should see the following verification of\u00a0Conjur secrets being retrieved by the application instances:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fa8bb2d elementor-widget elementor-widget-code-highlight\" data-id=\"fa8bb2d\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>++++++++++++++++++++++++++++++++++++++++++++++++++++\r\nDeployment of Conjur and demo applications is complete!\r\n++++++++++++++++++++++++++++++++++++++++++++++++++++<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f082ee8 elementor-widget elementor-widget-text-editor\" data-id=\"f082ee8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h4 style=\"font-family: Sailec, sans-serif;\">Exploring the Setup<\/h4><p>You\u00a0should now\u00a0have a local\u202f<a href=\"https:\/\/github.com\/kubernetes-sigs\/kind\">Kubernetes-in-Docker (KinD)<\/a>\u202fcluster with the following\u00a0Namespace\/Pod configuration:<\/p><p><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/kubernetes-demo-namespace-config-300x232.png\" sizes=\"(max-width: 662px) 100vw, 662px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/kubernetes-demo-namespace-config-300x232.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/kubernetes-demo-namespace-config-1024x792.png 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/kubernetes-demo-namespace-config-768x594.png 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/kubernetes-demo-namespace-config.png 1308w\" alt=\"\" width=\"662\" height=\"512\" \/><\/p><p>You can use\u00a0<code>kubectl<\/code>\u00a0to view the pods in the\u00a0<code>conjur-oss<\/code>\u00a0and\u00a0<code>app-test<\/code>\u00a0namespaces:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-faa4b87 elementor-widget elementor-widget-code-highlight\" data-id=\"faa4b87\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>$ kubectl get pods -n conjur-oss\r\nNAME                          READY   STATUS    RESTARTS   AGE\r\nconjur-cli-6d895db49d-g4t8k   1\/1Running017m\r\nconjur-oss-547867fdf8-bqgvz   2\/2Running021m\r\nconjur-oss-postgres-01\/1Running021m\r\n\r\n$ kubectl get pods -n app-test\r\nNAME                                       READY   STATUS    RESTARTS   AGE\r\nsecretless-pg-01\/1Running014m\r\nsummon-init-pg-01\/1Running014m\r\nsummon-sidecar-pg-01\/1Running014m\r\ntest-app-secretless-989486bc7-62blg2\/2Running014m\r\ntest-app-summon-init-7f9c8f4598-qmgl8      1\/1Running014m\r\ntest-app-summon-sidecar-5dc96cd94c-hwvx5   2\/2Running014m<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a69eaa0 elementor-widget elementor-widget-text-editor\" data-id=\"a69eaa0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In summary, you should now have\u00a0a\u00a0local\u202f<a href=\"https:\/\/github.com\/kubernetes-sigs\/kind\">Kubernetes-in-Docker (KinD)<\/a>\u202fcluster\u00a0that is running the following\u00a0deployments\u00a0for the\u00a0Conjur\u00a0demo:<\/p><table style=\"background-color: #ffffff; width: 646px;\" border=\"1\" data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1184\"><tbody><tr><td style=\"background-color: #e9e9e9;\" data-celllook=\"69905\"><span style=\"font-weight: bold;\">Namespace<\/span><\/td><td style=\"background-color: #e9e9e9;\" data-celllook=\"65809\"><span style=\"font-weight: bold;\">\u00a0Deployment<\/span><\/td><td style=\"background-color: #e9e9e9;\" data-celllook=\"69905\"><span style=\"font-weight: bold;\">Description\/Containers<\/span><\/td><\/tr><tr><td colspan=\"1\" rowspan=\"3\" data-celllook=\"69905\">conjur-oss<\/td><td data-celllook=\"69904\">\u00a0conjur-cli<\/td><td data-celllook=\"69904\">Conjur\u00a0CLI pod. This makes it easy to run\u00a0<a href=\"https:\/\/docs.conjur.org\/latest\/en\/Content\/Tools\/CLI_Help.htm\">Conjur\u00a0CLI<\/a>\u00a0commands to configure your\u00a0Conjur\u00a0cluster\u00a0(instructions\u00a0are available\u00a0<a href=\"https:\/\/github.com\/cyberark\/conjur-oss-helm-chart\/tree\/master\/examples\/kubernetes-in-docker#conjur-cli-pod\">here<\/a>)<\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0conjur-oss<\/td><td data-celllook=\"69904\"><p>Conjur\u00a0OSS pod\u00a0with 2\u00a0containers:<\/p><ul style=\"font-size: 14.4px;\"><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">Conjur\u00a0server container that has\u00a0the\u202f<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Services\/k8s_auth.htm\">Conjur\u00a0Kubernetes Authenticator<\/a>\u202fenabled<\/li><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\">NGINX container for terminating TLS<\/li><\/ul><\/td><\/tr><tr><td data-celllook=\"69904\">conjur-oss-postgres<\/td><td data-celllook=\"69904\">Postgresql\u00a0pod, provides\u00a0persistent database functionality for the\u00a0Conjur\u00a0server<\/td><\/tr><tr><td colspan=\"1\" rowspan=\"6\" data-celllook=\"69905\">app-test<\/td><td data-celllook=\"65808\">\u00a0secretless-pg<\/td><td data-celllook=\"69904\">Postgresql\u00a0backend for\u00a0the \u2018test-app-secretless\u2019 deployment<\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0summon-init-pg<\/td><td data-celllook=\"69904\">Postgresql\u00a0backend for the \u2018test-app-summon-init\u2019 deployment<\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0summon-sidecar-pg<\/td><td data-celllook=\"69904\">Postgresql\u00a0backend for the \u2018test-app-summon-sidecar\u2019 deployment<\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0test-app-secretless<\/td><td data-celllook=\"69904\"><a href=\"https:\/\/github.com\/conjurdemos\/pet-store-demo\">Pet Store<\/a>\u00a0app with\u00a0<a href=\"https:\/\/www.conjur.org\/solutions\/secretless-applications\/\">Secretless\u00a0Broker<\/a>\u202fsidecar\u00a0container to manage the application\u2019s database connection<\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0test-app-summon-init<\/td><td data-celllook=\"69904\"><p>Application pod with 2 containers:<\/p><ul style=\"font-size: 14.4px;\"><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\"><a href=\"https:\/\/github.com\/conjurdemos\/pet-store-demo\">Pet Store<\/a>\u00a0app\u00a0+\u00a0<a href=\"https:\/\/github.com\/cyberark\/summon\">Summon<\/a>\u202f(to inject the application\u2019s database credentials into the application environment)<\/li><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\"><a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_deployAuthenticatorSidecar.htm\">Conjur\u00a0Kubernetes Authenticator Client<\/a>\u202finit\u00a0container to\u00a0retrieve\u00a0the\u00a0Conjur\u00a0access token<\/li><\/ul><\/td><\/tr><tr><td data-celllook=\"69904\">\u00a0test-app-summon-sidecar<\/td><td data-celllook=\"69904\"><p>Application pod with 2 containers:<\/p><ul style=\"font-size: 14.4px;\"><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\"><a href=\"https:\/\/github.com\/conjurdemos\/pet-store-demo\">Pet Store<\/a>\u00a0app +\u00a0<a href=\"https:\/\/github.com\/cyberark\/summon\">Summon<\/a>\u202f(to inject the application\u2019s database credentials into the application environment)<\/li><li style=\"font-size: 14.4px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"13\" data-aria-posinset=\"0\" data-aria-level=\"1\"><a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_deployAuthenticatorSidecar.htm\">Conjur\u00a0Kubernetes Authenticator Client<\/a>\u202finit\u00a0container to retrieve the\u00a0Conjur\u00a0access token<\/li><\/ul><\/td><\/tr><\/tbody><\/table><h5><span style=\"font-weight: bold;\"><br \/>Application Secrets<\/span><\/h5><p>In this example, each \u2018<a href=\"https:\/\/github.com\/conjurdemos\/pet-store-demo\">Pet Store<\/a>\u2019 application requires its own set of credentials secrets to access its backend database. Each instance uses its attached authenticator broker\/client sidecar\/init\u00a0container to authenticate with\u00a0Conjur\u00a0and retrieve its private database credentials.<\/p><h5><span style=\"font-weight: bold;\"><br \/>The Secretless Broker<\/span><\/h5><p>One\u00a0of the Pet Store\u00a0deployments includes a\u00a0<a href=\"https:\/\/www.conjur.org\/solutions\/secretless-applications\/\">Secretless\u00a0Broker<\/a>\u00a0sidecar container.\u00a0By connecting to the\u00a0SecretlessBroker\u00a0rather than connecting to the backend database directly, the\u00a0Pet Store application\u00a0can\u00a0access database information (i.e. \u201cpets\u201d)\u00a0<span style=\"font-weight: bold;\"><i>without\u00a0knowing database connection credentials<\/i><\/span>.\u00a0For each connection request from the Pet Store application, the\u00a0Secretless Broker\u00a0will do the following:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-aria-posinset=\"0\" data-aria-level=\"1\">Authenticate with\u00a0Conjur<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-aria-posinset=\"0\" data-aria-level=\"1\">Retrieve a\u00a0Conjur\u00a0access token<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-aria-posinset=\"0\" data-aria-level=\"1\">Retrieve backend database credentials from\u00a0Conjur\u00a0using that access token<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-aria-posinset=\"0\" data-aria-level=\"1\">Inject credentials into the connection request, and\u00a0forward\u00a0it\u00a0to the database<\/li><\/ul><p>Once the connection is made,\u00a0Secretless\u00a0Broker seamlessly streams the connection between the client and the service.<\/p><h5><span style=\"font-weight: bold;\"><br \/>The Kubernetes Authenticator\u00a0Client<\/span><\/h5><p>The\u00a0<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_deployAuthenticatorSidecar.htm\">Kubernetes authenticator client<\/a>\u00a0uses\u00a0certificate-based\u00a0mutual\u00a0TLS to authenticate an application\u00a0and\u00a0retrieve\u00a0a\u00a0Conjur\u00a0access token, which it stores in shared\u00a0pod memory.\u00a0The access token can then be used by\u00a0Summon\u00a0or one of the available\u00a0<a href=\"https:\/\/www.conjur.org\/api\/\">Conjur\u00a0APIs<\/a>\u00a0to retrieve\u00a0application\u00a0secrets from\u00a0Conjur.<\/p><p>The client can run as either a sidecar or\u00a0init\u00a0container:<\/p><table style=\"background-color: #ffffff; width: 646px;\" border=\"1\" data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1184\"><tbody><tr><td data-celllook=\"69905\"><span style=\"font-weight: bold;\">Method<\/span><\/td><td data-celllook=\"65809\"><span style=\"font-weight: bold;\">Description<\/span><\/td><\/tr><tr><td data-celllook=\"69904\"><span style=\"font-weight: bold;\">Sidecar<\/span><\/td><td data-celllook=\"65808\">As a\u00a0sidecar container, the Kubernetes Authenticator Client\u00a0runs\u00a0as\u00a0a continuous process, generating a refreshed token value every 6 minutes. An access token has a time-to-live of 8 minutes.<\/td><\/tr><tr><td data-celllook=\"69904\"><span style=\"font-weight: bold;\">Init<\/span><\/td><td data-celllook=\"65808\">As an\u00a0init\u00a0container, the Kubernetes authenticator\u00a0provides the application with one, initial access token and then it exits. The provided access token expires after 8 minutes.<\/td><\/tr><\/tbody><\/table><h3>\u00a0<\/h3><h3><span style=\"font-weight: bold;\">How it Works: The\u00a0Conjur\u00a0Authentication Workflow<\/span><\/h3><p>The following\u00a0sequence diagram depicts\u00a0the\u00a0Conjur\u00a0authentication workflow\u00a0for the Kubernetes Authentication Client.<\/p><p><img decoding=\"async\" src=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/authn-k8s-flow-diagram-300x225.png\" sizes=\"(max-width: 597px) 100vw, 597px\" srcset=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/authn-k8s-flow-diagram-300x225.png 300w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/authn-k8s-flow-diagram-1024x770.png 1024w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/authn-k8s-flow-diagram-768x577.png 768w, https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/authn-k8s-flow-diagram.png 1272w\" alt=\"\" width=\"597\" height=\"448\" \/><\/p><h4 style=\"font-family: Sailec, sans-serif;\">The Certificate Signing Request (CSR)<\/h4><p>The\u00a0Conjur\u00a0authentication process uses\u00a0mutual TLS protocol\u00a0to ensure that both parties\u00a0can verify their peers.\u00a0The mutual TLS protocol requires that the client has a\u00a0client certificate that has been signed by a trusted CA (in this case,\u00a0Conjur\u00a0itself).<\/p><p>The Kubernetes Authentication Client begins the\u00a0authentication process by\u00a0sending a Certificate Signing Request (CSR) to\u00a0Conjur.\u00a0The CSR includes\u202f<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_AppIdentity.htm?TocPath=Integrations%7COpenShift%252C%20Kubernetes%252C%20and%20GKE%7C_____2\">application identity<\/a>\u202fthat the\u00a0application\u00a0pod would like to use to authenticate,\u00a0as well as information about the\u00a0application pod that is making the request.<\/p><h4 style=\"font-family: Sailec, sans-serif;\">Verifying the Client:\u00a0Conjur\u00a0Application Identity<\/h4><p>In this demo, the\u202f<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_AppIdentity.htm?TocPath=Integrations%7COpenShift%252C%20Kubernetes%252C%20and%20GKE%7C_____2\">application identity<\/a>\u202fthat is\u00a0provided in the CSR includes\u00a0Kubernetes-native attributes\u00a0of the application\u00a0instance:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"1\" data-aria-level=\"1\">Kubernetes Namespace name<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"2\" data-aria-level=\"1\">Kubernetes\u00a0ServiceAccount\u00a0name<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"3\" data-aria-level=\"1\">Kubernetes Deployment name<br \/><br \/><\/li><\/ul><p>The\u00a0Conjur\u00a0server\u00a0incorporates a\u00a0<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Services\/k8s_auth.htm\">Conjur\u00a0Kubernetes Authenticator<\/a>\u00a0(also referred to as \u2018authn-k8s\u2019)\u00a0plugin\u00a0that\u00a0examines this\u00a0application identity, and compares it against the Kubernetes API to verify the identity\u00a0of the client.<\/p><h4 style=\"font-family: Sailec, sans-serif;\">Certificate\u00a0Injection<\/h4><p>If verification\u00a0of the client\u00a0succeeds, the client certificate is injected into the application pod using the Kubernetes API.\u00a0Since\u00a0this injection is done\u00a0out-of-band (rather than\u00a0returning it\u00a0directly\u00a0in the request response), the\u00a0Conjur\u00a0authenticator ensures that the client certificate is delivered to the pod that matches the metadata in the CSR.<\/p><p>The certificate expires and is renewed automatically on a regular basis to reduce the chances of a malicious third party being able to use a compromised certificate to assume the application pod\u2019s identity.<\/p><h4 style=\"font-family: Sailec, sans-serif;\">Establishing Mutual TLS and Requesting\u00a0and\u00a0Access\u00a0Token<\/h4><p>After receiving a client certificate, the authentication client uses it to establish a mutual TLS connection with\u202fConjur\u202fand requests a short-lived access token. The access token is written to shared pod memory\u00a0so that it can\u00a0be used with Summon to retrieve secrets from\u202fConjur. The token is short-lived to reduce the possibility that it can be used by a malicious third party if it is somehow compromised.<\/p><h4 style=\"font-family: Sailec, sans-serif;\">Retrieve Secrets<\/h4><p>The application can now use the access token to retrieve secrets with\u00a0<a href=\"https:\/\/github.com\/cyberark\/summon\">Summon<\/a>. Summon runs the application as a sub-process and provides secret values in environment variables.<\/p><h4 style=\"font-family: Sailec, sans-serif;\">Security\u00a0Policy as Code<\/h4><p>This demo illustrates how Conjur supports the concept of \u201c<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Policy\/policy-intro.html?tocpath=Fundamentals%7CPolicy%20Management%7CSecurity%20policy%20as%20code%7C_____0\">Security Policy as Code<\/a>.\u201d Conjur security policies are defined by creating human-readable, declarative, YAML manifest files that articulate such things as:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\">Human users who can access\u00a0Conjur\u00a0through the CLI, or the API<\/li><li style=\"font-size: 16px;\">Applications that can authenticate to Conjur programmatically and access data<\/li><li style=\"font-size: 16px;\">Variables that represent the secrets that will be stored in Conjur<\/li><li style=\"font-size: 16px;\">Webservices that can provide services to Conjur<br \/><br \/><\/li><\/ul><p>Policy manifest files are loaded into\u00a0Conjur\u00a0using the Client CLI or REST API.\u00a0Conjur\u202finterprets and transforms your policy statements into definitive database records. You can safely re-apply policy any number of times.<\/p><p>A policy file is declarative, meaning that the rules become data in the database; it is not executable code. Therefore, loading a policy file does not have any effect other than to create and update the role-based access control model in your\u202fConjur\u202fappliance. These properties make policy files\u00a0automation-friendly.<\/p><p>Policy files can be checked into source control, and a review process can be established for managing changes to policy files just like other controlled files.<\/p><p>The demo scripts generate security policy manifests that can be viewed from your local host<\/p><h4 style=\"font-family: Sailec, sans-serif;\"><span style=\"font-weight: bold;\"><br \/>Viewing Rendered\u00a0Conjur-OSS Security Policy<\/span><\/h4><p>The demo scripts render several\u00a0security policy manifest files that define\u00a0application-specific\u00a0Conjur\u00a0security policy. These manifest files are loaded into the\u00a0Conjur\u00a0server to configure which applications are permitted to access\u00a0which\u00a0secrets from\u00a0Conjur.\u00a0(Typically, the loading of security policy is done by a security administrator.)<\/p><p>These files can be viewed in the\u202ftemp\/kubernetes-conjur-demo\/policy\/generated\u202fsubdirectory:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"1\" data-aria-level=\"1\">app-access.yml<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"2\" data-aria-level=\"1\">generated\/app-test.app-identity.yml<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"3\" data-aria-level=\"1\">generated\/app-test.cluster-authn-svc.yml<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-aria-posinset=\"1\" data-aria-level=\"1\">generated\/app-test.project-authn.yml<\/li><\/ul><h5><span style=\"font-weight: bold;\"><br \/>Example:\u00a0Conjur\u00a0Host and Application Identity Definition<\/span><\/h5><p>As an\u00a0example, let\u2019s look at the entry in\u202fgenerated\/app-test.project-authn.yml\u202fthat defines the\u00a0Conjur\u00a0application identity for the\u202ftest-app-secretless\u202fapplication that is deployed by the demo scripts:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-96a10ec elementor-widget elementor-widget-code-highlight\" data-id=\"96a10ec\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>- !host\r\n  id: test-app-secretless\r\n  annotations:\r\n    authn-k8s\/namespace: app-test\r\n    authn-k8s\/service-account: test-app-secretless\r\n    authn-k8s\/deployment: test-app-secretless\r\n    authn-k8s\/authentication-container-name: secretless\r\n    kubernetes: \"true\"<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b5656ba elementor-widget elementor-widget-text-editor\" data-id=\"b5656ba\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In this host definition, the annotations specify that in order for the\u00a0Secretless\u00a0Broker to successfully authenticate the\u202f<code>test-app-secretless<\/code>\u202fdeployment, all of the following need to be true:<\/p><ul style=\"font-size: 16px; background-color: #ffffff;\"><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"1\" data-aria-level=\"1\">Application is running in the\u202fapp-test\u202fnamespace<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"2\" data-aria-level=\"1\">Application is using the\u202ftest-app-secretless\u202fServiceAccount<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"2\" data-aria-level=\"1\">Application\u2019s deployment name is\u202ftest-app-secretless<\/li><li style=\"font-size: 16px;\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"2\" data-aria-level=\"1\">Application pod contains a container named\u202fsecretless<\/li><\/ul><h5><span style=\"font-weight: bold;\"><br \/>Another\u00a0Example: Security Policy for\u00a0Applications Secrets Access<\/span><\/h5><p>As another example, we can take a look at the security policy that is used to grant privileges to secrets that are specific to the Pet Store application instance that incorporates a\u00a0Secretless\u00a0Broker sidecar\u00a0container. This security policy can be found in the app-access.yml\u00a0file, and looks like this:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d1da497 elementor-widget elementor-widget-code-highlight\" data-id=\"d1da497\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>- !policy\r\n  id: test-secretless-app-db\r\n  owner: !group secrets_admin\r\n  annotations:\r\n    description: This policy contains the creds to access the secretless app DB\r\n  body:- &secretless-variables\r\n      - !variable password\r\n      - !variable url\r\n      - !variable port\r\n      - !variable host\r\n      - !variable username\r\n\r\n    - !permit\r\n      role: !layer \/test-app\r\n      privileges: [ read, execute ]\r\n      resources: *secretless-variables<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d070b9a elementor-widget elementor-widget-text-editor\" data-id=\"d070b9a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>This security policy defines several\u00a0Conjur\u00a0variables that are used for managing application-specific database credentials for the Pet Store instance that incorporates a\u00a0Secretless\u00a0Broker sidecar container. This policy is owned by the \u2018secrets_admin\u2019\u00a0group and\u00a0read\/execute access is granted to any entities in the \u2018test-app\u2019 layer<\/p><h3><span style=\"font-weight: bold;\"><br \/>Role-Based Access Control (RBAC)<\/span><\/h3><p>The security policy examples described in the previous section illustrate how\u00a0Conjur\u00a0enables organizations to use\u00a0<a href=\"https:\/\/www.conjur.org\/solutions\/rbac\/\">Role-Based Access Control (RBAC)<\/a>\u00a0in managing security policies and secrets access. RBAC\u00a0is the definition of organizational roles such as administrators, supervisors, users with full access, and users with read-only access. Organizational users are assigned a role based on the access they require to do their job. The same concept can be applied on non-human identities and be leveraged to provide access to applications based on predefined RBAC policies.<\/p><p>The RBAC usually assigns access rights to a group and not to a specific user. In the case of non-human identities, a group of hosts (a non-human entity), is called a \u201clayer\u201d and can be assigned access rights the same way groups can. This approach reduces the overhead to manage users or non-humans, eliminates access errors, and facilitates auditing.<\/p><h3><span style=\"font-weight: bold;\"><br \/>Cleaning Up<\/span><\/h3><p>When you are done with the Kubernetes\u00a0Conjur\u00a0Demo, you can clean up the demo\u00a0simply by deleting the Kubernetes-in-Docker cluster:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fdce225 elementor-widget elementor-widget-code-highlight\" data-id=\"fdce225\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript line-numbers\">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp>kind delete cluster<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1aff3f06 elementor-widget elementor-widget-text-editor\" data-id=\"1aff3f06\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<article><header><\/header><div><pre><b style=\"color: #00b2a9; font-family: Sailec, sans-serif; font-size: 1.75rem;\">Conclusion<\/b><\/pre><p>I hope that you enjoyed this hands-on demonstration of\u00a0<a href=\"https:\/\/www.conjur.org\/why-conjur\/\">Conjur<\/a>\u00a0and\u00a0<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Services\/k8s_auth.htm?tocpath=Fundamentals%7CAuthentication%7C_____8\">Conjur\u00a0Kubernetes Authentication<\/a>.<\/p><p>With this demonstration, we saw that\u00a0<a href=\"https:\/\/www.conjur.org\/why-conjur\/\">Conjur<\/a>\u00a0is an open-source, centralized platform that\u00a0can be used to\u00a0consistently enforce security policies for non-human identities for secrets management and access control.<\/p><p>We saw\u00a0how\u00a0Conjur\u00a0uses\u00a0the\u202f<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Operations\/Services\/k8s_auth.htm\">Conjur\u00a0Kubernetes Authenticator<\/a>\u00a0plugin to authenticate applications\u00a0using\u202f<a href=\"https:\/\/docs.conjur.org\/Latest\/en\/Content\/Integrations\/Kubernetes_AppIdentity.htm?TocPath=Integrations%7COpenShift%252C%20Kubernetes%252C%20and%20GKE%7C_____2\">Conjur\u00a0Kubernetes\u00a0application identity<\/a>.<\/p><p>We also saw some of the authentication clients that can be integrated with applications in order to facilitate\u00a0Conjur\u00a0authentication and secrets access, including:<\/p><ul><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"1\" data-aria-level=\"1\">Secretless\u00a0Broker<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-aria-posinset=\"2\" data-aria-level=\"1\">Kubernetes Authentication Client (either as a sidecar or\u00a0init\u00a0container)<br \/><br \/><\/li><\/ul><p>Finally, this demonstration\u00a0illustrated just some of the security policy best practices and concepts that are facilitated by\u00a0Conjur\u00a0including:<\/p><ul><li>Strong authentication, including use of:<br \/>\u2013 Certificate Signing Requests<br \/>\u2013 Mutual TLS<br \/>\u2013 Conjur Kubernetes application identity<\/li><\/ul><ul><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-aria-posinset=\"0\" data-aria-level=\"1\">Least privilege<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-aria-posinset=\"0\" data-aria-level=\"1\">Security policy as code<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-aria-posinset=\"0\" data-aria-level=\"1\">Role-based access control (RBAC)<\/li><\/ul><h3>Next Steps for Securing Kubernetes Secrets<\/h3><p>Check out our new hosted\u00a0<a href=\"https:\/\/www.conjur.org\/get-started\/interactive\/\">interactive tutorials<\/a>\u00a0for\u00a0<a href=\"https:\/\/www.conjur.org\/get-started\/interactive\/secure-ci-cd-pipelines\/\">securing CI\/CD pipelines<\/a>,\u00a0<a href=\"https:\/\/www.conjur.org\/get-started\/interactive\/secure-ansible-automation\/\">securing Ansible automation<\/a>, and\u00a0<a href=\"https:\/\/www.conjur.org\/get-started\/interactive\/secure-kubernetes-secrets\/\">securing Kubernetes secrets<\/a>\u00a0to learn more. Also, sign up to the\u00a0<a href=\"https:\/\/www.conjur.org\/newsletter\/\">DevSecOps newsletter<\/a>\u00a0to get the latest open source community news, tutorials, blogs, and product news. Finally, join the CyberArk Commons\u00a0<a href=\"https:\/\/discuss.cyberarkcommons.org\/\">Community<\/a>\u00a0to connect with me and other developers, see you there!<\/p><\/div><\/article><nav><div><p><em>This article was originally posted on <a href=\"https:\/\/www.conjur.org\/blog\/\">CyberArk Conjur<\/a>.<br \/><\/em><\/p><p><em>Does your business work with Kubernetes? If you\u2019re interested in developing expert technical content that performs, <a href=\"https:\/\/contentlab.com\/contact\/\">let\u2019s have a conversation<\/a>\u00a0today.<\/em><\/p><\/div><\/nav>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Conjur\u00a0is an open-source, centralized platform that\u00a0can be used to\u00a0consistently enforce security policies for non-human identities for secrets management and access control.<\/p>\n","protected":false},"author":3,"featured_media":4856,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[241,278,18],"tags":[317,298,299],"hashtags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab\" \/>\n<meta property=\"og:description\" content=\"Conjur\u00a0is an open-source, centralized platform that\u00a0can be used to\u00a0consistently enforce security policies for non-human identities for secrets management and access control.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/\" \/>\n<meta property=\"og:site_name\" content=\"Technical Content Marketing | ContentLab\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-20T14:23:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-16T19:02:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1746\" \/>\n\t<meta property=\"og:image:height\" content=\"530\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ContentLab\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ContentLabIO\" \/>\n<meta name=\"twitter:site\" content=\"@ContentLabIO\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ContentLab\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/\"},\"author\":{\"name\":\"ContentLab\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532\"},\"headline\":\"Securing Secrets in Kubernetes\",\"datePublished\":\"2021-04-20T14:23:44+00:00\",\"dateModified\":\"2021-11-16T19:02:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/\"},\"wordCount\":2125,\"publisher\":{\"@id\":\"https:\/\/contentlab.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png\",\"keywords\":[\"Conjur\",\"DevOps\",\"Kubernetes\"],\"articleSection\":[\"DevOps\",\"Hands-on Tutorial\",\"Portfolio\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/\",\"url\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/\",\"name\":\"Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab\",\"isPartOf\":{\"@id\":\"https:\/\/contentlab.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png\",\"datePublished\":\"2021-04-20T14:23:44+00:00\",\"dateModified\":\"2021-11-16T19:02:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage\",\"url\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png\",\"contentUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png\",\"width\":1746,\"height\":530},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/contentlab.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Securing Secrets in Kubernetes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/contentlab.com\/#website\",\"url\":\"https:\/\/contentlab.com\/\",\"name\":\"Technical Content Marketing | ContentLab\",\"description\":\"Technical Content Marketing Done Right.\",\"publisher\":{\"@id\":\"https:\/\/contentlab.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/contentlab.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/contentlab.com\/#organization\",\"name\":\"ContentLab.io\",\"url\":\"https:\/\/contentlab.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png\",\"contentUrl\":\"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png\",\"width\":768,\"height\":768,\"caption\":\"ContentLab.io\"},\"image\":{\"@id\":\"https:\/\/contentlab.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/ContentLabIO\",\"https:\/\/www.linkedin.com\/company\/17893315\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532\",\"name\":\"ContentLab\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/contentlab.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g\",\"caption\":\"ContentLab\"},\"description\":\"ContentLab provides high-quality written articles, tutorials, courses, and other technical marketing materials to industry leaders. We create no-nonsense tech content that\u2019s purpose-built to attract, educate, and engage your technical audience.\",\"sameAs\":[\"https:\/\/contentlab.op\"],\"url\":\"https:\/\/contentlab.com\/author\/contentlab\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/","og_locale":"en_US","og_type":"article","og_title":"Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab","og_description":"Conjur\u00a0is an open-source, centralized platform that\u00a0can be used to\u00a0consistently enforce security policies for non-human identities for secrets management and access control.","og_url":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/","og_site_name":"Technical Content Marketing | ContentLab","article_published_time":"2021-04-20T14:23:44+00:00","article_modified_time":"2021-11-16T19:02:37+00:00","og_image":[{"width":1746,"height":530,"url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","type":"image\/png"}],"author":"ContentLab","twitter_card":"summary_large_image","twitter_creator":"@ContentLabIO","twitter_site":"@ContentLabIO","twitter_misc":{"Written by":"ContentLab","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#article","isPartOf":{"@id":"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/"},"author":{"name":"ContentLab","@id":"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532"},"headline":"Securing Secrets in Kubernetes","datePublished":"2021-04-20T14:23:44+00:00","dateModified":"2021-11-16T19:02:37+00:00","mainEntityOfPage":{"@id":"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/"},"wordCount":2125,"publisher":{"@id":"https:\/\/contentlab.com\/#organization"},"image":{"@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage"},"thumbnailUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","keywords":["Conjur","DevOps","Kubernetes"],"articleSection":["DevOps","Hands-on Tutorial","Portfolio"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/contentlab.com\/securing-secrets-in-kubernetes\/","url":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/","name":"Securing Secrets in Kubernetes &#183; Technical Content Marketing | ContentLab","isPartOf":{"@id":"https:\/\/contentlab.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage"},"image":{"@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage"},"thumbnailUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","datePublished":"2021-04-20T14:23:44+00:00","dateModified":"2021-11-16T19:02:37+00:00","breadcrumb":{"@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#primaryimage","url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","contentUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","width":1746,"height":530},{"@type":"BreadcrumbList","@id":"https:\/\/www.conjur.org\/blog\/securing-secrets-in-kubernetes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/contentlab.com\/"},{"@type":"ListItem","position":2,"name":"Securing Secrets in Kubernetes"}]},{"@type":"WebSite","@id":"https:\/\/contentlab.com\/#website","url":"https:\/\/contentlab.com\/","name":"Technical Content Marketing | ContentLab","description":"Technical Content Marketing Done Right.","publisher":{"@id":"https:\/\/contentlab.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/contentlab.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/contentlab.com\/#organization","name":"ContentLab.io","url":"https:\/\/contentlab.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/contentlab.com\/#\/schema\/logo\/image\/","url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png","contentUrl":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/11\/favicon-1.png","width":768,"height":768,"caption":"ContentLab.io"},"image":{"@id":"https:\/\/contentlab.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/ContentLabIO","https:\/\/www.linkedin.com\/company\/17893315\/"]},{"@type":"Person","@id":"https:\/\/contentlab.com\/#\/schema\/person\/e1b8cacc1019e83e8d6cd9ab1a049532","name":"ContentLab","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/contentlab.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3929e740ba8fe876f001a63220500e8e?s=96&d=mm&r=g","caption":"ContentLab"},"description":"ContentLab provides high-quality written articles, tutorials, courses, and other technical marketing materials to industry leaders. We create no-nonsense tech content that\u2019s purpose-built to attract, educate, and engage your technical audience.","sameAs":["https:\/\/contentlab.op"],"url":"https:\/\/contentlab.com\/author\/contentlab\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/contentlab.com\/wp-content\/uploads\/2021\/10\/portfoliofeature47f.png","_links":{"self":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3491"}],"collection":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/comments?post=3491"}],"version-history":[{"count":9,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3491\/revisions"}],"predecessor-version":[{"id":5393,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/posts\/3491\/revisions\/5393"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/media\/4856"}],"wp:attachment":[{"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/media?parent=3491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/categories?post=3491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/tags?post=3491"},{"taxonomy":"hashtags","embeddable":true,"href":"https:\/\/contentlab.com\/wp-json\/wp\/v2\/hashtags?post=3491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}