call kube-apiserver • Operations with secrets are audit logged ### Kubernetes secrets: 1.7 EncryptionConfig ## Master etcd ![Image](/uploads/documents/c/8/b/a/c8ba83e6f6c7cff81c6e56e8b4d2ac00/p26_1 locally managed key • EncryptionConfig for secrets • Multiple provider options o aesgcm ☐ aesbc ☐ secretbox ### Kubernetes secrets: 1.7 EncryptionConfig kind: EncryptionConfig apiVersion: v1 resources: secrets with a locally managed key, which is then encrypted with a centrally managed key - EncryptionConfig uses aescbc with a KMS provider • Sidecar pod for the KMS plugin ## Terminology and Notation

file mode is 0600 • The file owner is root:root • The file contains: apiVersion: v1 kind: EncryptionConfig resources: - resources: - secrets providers: - aescbc: keys: yaml chmod 0600 /etc/kubernetes/encryption.yaml • Set the contents to: apiVersion: v1 kind: EncryptionConfig resources: - resources: - secrets: providers: - aescbc: keys:

appropriate (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver configured (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file, choose aescbc, kms or secretbox as the encryption provider. ##### Audit

appropriate (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver configured (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file, choose aescbc, kms or secretbox as the encryption provider. ##### Audit

=> SecretKeyData mapping kms-plugin config apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfig resources: - resources: - secrets: providers: - kms: name:

(Automated) Result: pass Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver Self-Assessment Guide - Rancher v2.5.4 Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file, choose aescbc, kms or secretbox as the encryption provider. ## Audit: