What are the best practices for managing secrets in Kubernetes for a secure DevSecOps workflow?

All answers to this question.

While Kubernetes Secrets are a start, for enterprise DevSecOps, you really should implement the "External Secrets Operator" or "Secrets Store CSI Driver." These allow K8s to pull secrets directly from providers like AWS Secrets Manager or HashiCorp Vault. If you are already heavily invested in a specific cloud provider, their native secret manager is usually sufficient and easier to manage regarding IAM roles. However, if you are running a multi-cloud or hybrid environment, HashiCorp Vault is the gold standard because of its robust auditing, dynamic secret generation, and platform-agnostic nature.

   Answered 2024-09-22 by Emily Davis

Are you planning to use dynamic secrets, where the credentials are created on-the-fly and expire automatically, or just static keys? This choice significantly changes which tool is better for your team.

   Answered 2024-09-24 by Christopher Brown

• We are leaning towards static keys for now to simplify the migration, but the security team is pushing for dynamic secrets for our RDS databases. If we go with HashiCorp Vault, the setup is more complex but the 'lease' functionality essentially eliminates the risk of leaked long-lived credentials. It's a bit of a trade-off between implementation speed and long-term security posture

     Commented 2024-09-25 by James Wilson

For most teams, using the Secrets Store CSI driver with AWS or Azure is the path of least resistance. It mounts secrets as volumes, which is much more secure than environment variables.

   Answered 2024-09-26 by Patricia Taylor

• Patricia is right. Using the CSI driver to mount secrets as files prevents them from being accidentally logged in the container's environment, which is a common but dangerous DevSecOps pitfall.

     Commented 2024-09-27 by Jennifer Lopez