I have been concerned about leaving /etc/kubernetes/admin.conf (i.e. $KUBECONFIG) unencrypted on disk, for it essentially contains a Kubernetes cluster's root credentials, and an intruder could obviously do a lot of harm with those.

So far, I have kept admin.conf encrypted with encfs and have for the most part resorted to unencrypting it (manually) only in cases of emergency (when I could no longer log into the Kubernetes cluster with an administrator OIDC token). This has served well for several years. But the simple encryption layer has its downsides: in particular, it makes cluster upgrades with kubeadm upgrade plan somewhat brittle. I just ran into an error "failed to renew certificate [...] unable to sign certificate admin.conf", which could be related. My current hunch is that I better decommission the encfs-based mechanism and investigate more suitable alternatives.

Hence I am wondering: can Kubernetes Key Management Service (KMS) and its providers (e.g. Thales KSM Plugin) also manage admin.conf encrypted at rest, or do those only have secrets (inside etcd) in their scopes? I suspect the second is the case, but want to be sure, for I am facing an important (re)design decision.

P.S. I also noticed that various security controls (e.g. "C-0104 - Ensure that the admin.conf file permissions are set to 600") make lighter recommendations. So perhaps the "correct" line of thinking is: admin.conf encrypted at rest is too late a line of defense: the focus must be on always keeping intruders off cluster nodes. Or perhaps KSM could not even "bootstrap" with admin.conf being encrypted by itself.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.