Questão de Kubernetes Security #019e3a4f

Summary

By default, Kubernetes Secrets are stored in plaintext within the etcd datastore, but they are base64 encoded when retrieved via the API. Base64 encoding is not encryption; it is a simple encoding scheme that provides no confidentiality. The correct answer is that the values are base64 encoded.

How it Works

Kubernetes Secrets are designed to store sensitive information such as passwords, tokens, and keys. When you create a Secret using kubectl create secret, the data you provide is base64 encoded and stored in the API object. The API server stores the Secret object in etcd. By default, etcd does not encrypt the data at rest; the Secret data is stored as plaintext in etcd. However, when you retrieve a Secret via the API (e.g., kubectl get secret mysecret -o yaml), the values are displayed as base64-encoded strings. This encoding is merely a representation format for binary data and does not provide any security.

Why the Correct Value is Right

The statement "The values are base64 encoded" is correct because that is the default behavior of the Kubernetes API when returning Secret data. Base64 encoding is used to allow arbitrary binary data to be represented as ASCII strings in YAML or JSON manifests. It is not a security measure.

Why the Incorrect Values are Wrong

• The values use AES Symmetric Encryption: This is incorrect by default. Kubernetes does not encrypt Secrets at rest unless you explicitly configure encryption at rest using a feature like EncryptionConfiguration with a provider such as aescbc or kms. Without such configuration, Secrets are stored in plaintext in etcd.
• The values are stored in plain text: This is partially true for storage in etcd (without encryption at rest), but the question asks about the level of protection applied to the data in the Kubernetes API. When accessed via the API, the values are base64 encoded, not plaintext. However, the encoding does not protect the data; it is still easily decoded. The more precise default behavior is base64 encoding.
• The values are encoded with SHA256 hashes: SHA256 is a cryptographic hash function, which is one-way and not reversible. Secrets need to be used in their original form (e.g., as a password or token), so they cannot be hashed. Kubernetes does not hash Secret data; it stores the original value (base64 encoded).

Additional Context

To actually protect Secret data, you should enable encryption at rest for etcd, use RBAC to limit access, and consider using external secrets management systems like HashiCorp Vault. The default base64 encoding is trivial to reverse and should not be considered a security measure.