Presentation on TDC 2018: Protecting your K8s with Valut

1. Protegendo seu K8s com Vault
Juliano Alves
@vonjuliano

2. ● Formado em engenharia de
Software pela PUC/SP
● Java / Scala / Clojure / Ruby /
C# / Python
● Palestrante em eventos como
Agile Brazil, TDC, .Net
Architects, DevDay
● Open Source S2

6. - Variáveis de ambiente
- K8s secrets
- Plain text

7. Plain text

9. ● Secure Secret Storage
● Dynamic Secrets
● Data Encryption
● Leasing and Renewal
● Revocation
Features

11. Database

12. K8s

13. ---
apiVersion:extensions/v1beta1
kind:Deployment
metadata:
name:my-deploy
namespace:myNamespace
spec:
replicas:1
template:
metadata:
labels:
app:my-app
spec:
containers:
- name:my-container
---
apiVersion:v1
kind:ServiceAccount
metadata:
name:myServiceAccount
namespace:myNamespace

14. ---
apiVersion:extensions/v1beta1
kind:Deployment
metadata:
name:my-deploy
namespace:myNamespace
spec:
replicas:1
template:
metadata:
labels:
app:my-app
spec:
serviceAccountName:myServiceAccount
containers:
- name:my-container
---
apiVersion:v1
kind:ServiceAccount
metadata:
name:myServiceAccount
namespace:myNamespace

15. ---
apiVersion:extensions/v1beta1
kind:Deployment
metadata:
name:my-deploy
namespace:myNamespace
spec:
replicas:1
template:
metadata:
labels:
app:my-app
spec:
volumes:
-name:database-secret
emptyDir:{}
serviceAccountName:myServiceAccount
containers:
- name:my-container
volumeMounts:
-name:database-secret
mountPath:/etc/database-creds
---
apiVersion:v1
kind:ServiceAccount
metadata:
name:myServiceAccount
namespace:myNamespace

16. ---
apiVersion:extensions/v1beta1
kind:Deployment
metadata:
name:my-deploy
namespace:myNamespace
spec:
replicas:1
template:
metadata:
labels:
app:my-app
spec:
volumes:
-name:database-secret
emptyDir:{}
-name:database-template
configMap:
name:my-template
serviceAccountName:myServiceAccount
containers:
- name:my-container
volumeMounts:
-name:database-secret
mountPath:/etc/database-creds
---
apiVersion:v1
kind:ServiceAccount
metadata:
name:myServiceAccount
namespace:myNamespace
---
apiVersion:v1
kind:ConfigMap
metadata:
name:my-template
namespace:myNamespaces
data:
database.yml.in:|
username:{{ .Username}}
password:{{ .Password}}

17. Building

18. Deployment

20. Perguntas?

21. Protegendo seu K8s com Vault
Juliano Alves
@vonjuliano
https://www.uswitch.com/vacancies/
OBRIGADO!