Skip to content

Add ADR for Sealed Secrets as secret management #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Add ADR for Sealed Secrets as secret management #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions docs/software_ready/ADRs/sealed_secrets_as_secret_management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
---
title: "Sealed Secrets as Secret Management"
date: "2025-03-31"
---

| status: | date: | decision-makers: |
| --- | --- | --- |
| proposed | 2025-03-31 | Kasper Møller |

## Context and Problem Statement

Managing secrets in Kubernetes is a critical aspect of ensuring the security of sensitive data such as API keys, passwords, and certificates. Kubernetes Secrets, while convenient, store data in plaintext by default, which poses a security risk. To increase security of the sensitive data at rest, encryption is necessary.

### Do i need it

If it is possible to use a cloud-provided security management tool (e.g., AWS KMS, Azure Key Vault, or GCP KMS), it is recommended to use those tools for secret management. However, when cloud-based solutions are not viable, a robust and secure alternative is required to manage secrets effectively.

### The criterias of making a choice

* **Security:** Is there sensitive data that requires stronger protection than Kubernetes' default base64 encoding?
* **Scalability:** What is the scale of the application, and how many secrets need to be managed?
* **Expertise:** What level of experience does the team have with secret management tools?

## Considered Options

* **SOPS:** A simple and lightweight tool for managing secrets. It encrypts YAML, JSON, ENV, INI and BINARY files using a variety of backends (e.g., AWS KMS, GCP KMS, Azure Key Vault, age, and PGP).
* **Sealed Secrets:** A Kubernetes-native solution that encrypts secrets using a controller and a public/private key pair. It is simple to use but tightly coupled to Kubernetes.
* **HashiCorp Vault:** A feature-rich secret management solution.

## Decision Outcome

Chosen option: **Sealed Secrets**, because of the simple integration in the Kubernetes cluster and the management of encryption and decryption.

**Sealed Secrets** is an open-source solution provided by Bitnami that encrypts secrets using a public/private key pair. The encrypted secrets can be safely stored in version control systems like Git, ensuring secure collaboration and auditability. The decryption happens inside the Kubernetes cluster, where the private key is securely managed by the **Sealed Secrets** controller.

**Sealed Secrets** also supports secret rotation, with a default rotation period of 30 days. However, manual intervention is required to re-encrypt existing secrets. Additionally, since **Sealed Secrets** retains all private keys for decryption, it is necessary to manually remove legacy keys once all secrets have been updated.

### Consequences

* **Good, because:**
* Seamless integration with Kubernetes clusters.
* Secrets can be safely stored in Git repositories.
* Simplifies the encryption and decryption process.
* Option of rotation the public/private key pair.

* **Bad, because:**
* Manual tasks to update secrets to latest encryption could be an issue in larger projects if no strategy is made.
2 changes: 1 addition & 1 deletion docs/software_ready/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ title: Getting your software ready
| Problem domain | Description | Reason for importance | Tool recommendation |
|:---:|:---:|:---:|:---:|
| Image Registry | A common place to store and fetch images | High availability, secure access control | [Harbor](ADRs/harbor_as_image_registry.md) |
| Secret Management | Securely store and manage sensitive information like passwords and API keys | Prevent unauthorized access and data leaks | |
| Secret Management | Securely store and manage sensitive information like passwords and API keys | Prevent unauthorized access and data leaks | [Sealed Secrets](ADRs/sealed_secrets_as_secret_management.md) |
| Ingress Controller / Gateway API | Manage external access to services in the cluster | Enable routing, load balancing, and secure communication | |
| GitOps / Deployment Pipelines | Automate application deployments using Git as the source of truth | Ensure consistency, traceability, and faster deployments | |
| Monitoring Infrastructure | Observe and analyze the health and performance of the cluster and applications | Proactive issue detection and resolution | |
Expand Down