Preface |
|
xi | |
Acknowledgments |
|
xiii | |
About this book |
|
xv | |
About the authors |
|
xviii | |
About the cover illustration |
|
xix | |
|
PART 1 Secrets and Kubernetes |
|
|
1 | (32) |
|
|
3 | (7) |
|
|
4 | (1) |
|
1.2 Taking full advantage of the Kubernetes ecosystem |
|
|
5 | (1) |
|
1.3 Not everything is a Secret |
|
|
5 | (1) |
|
1.4 Bringing secrets management and Kubernetes together |
|
|
6 | (3) |
|
|
9 | (1) |
|
2 An introduction to Kubernetes and Secrets |
|
|
10 | (23) |
|
2.1 Kubernetes architecture |
|
|
11 | (2) |
|
|
12 | (1) |
|
|
13 | (1) |
|
2.2 Deploying workloads in Kubernetes |
|
|
13 | (6) |
|
|
13 | (2) |
|
|
15 | (4) |
|
|
19 | (1) |
|
2.3 Managing application configuration |
|
|
19 | (6) |
|
|
19 | (6) |
|
2.4 Using Kubernetes Secrets to store sensitive information |
|
|
25 | (8) |
|
Secrets are encoded in Base64 |
|
|
26 | (2) |
|
Secrets are mounted in a temporary file system |
|
|
28 | (1) |
|
Secrets can be encrypted at rest |
|
|
28 | (1) |
|
|
29 | (4) |
|
|
33 | (116) |
|
3 Securely storing Secrets |
|
|
35 | (26) |
|
3.1 Storing Kubernetes manifests at rest |
|
|
36 | (4) |
|
Capturing resources for declarative configuration |
|
|
37 | (3) |
|
3.2 Tools for securely storing Kubernetes resources |
|
|
40 | (5) |
|
|
40 | (5) |
|
|
45 | (6) |
|
Custom resource definitions (CRDs) |
|
|
46 | (1) |
|
|
47 | (4) |
|
3.4 Managing Secrets within Kubernetes package managers |
|
|
51 | (7) |
|
Deploying the Greeting Demo Helm chart |
|
|
52 | (2) |
|
|
54 | (4) |
|
|
58 | (3) |
|
Ansible Vault secret key rotation |
|
|
58 | (1) |
|
Sealed Secrets key rotation |
|
|
59 | (1) |
|
|
60 | (1) |
|
4 Encrypting data at rest |
|
|
61 | (18) |
|
4.1 Encrypting secrets in Kubernetes |
|
|
62 | (7) |
|
Data at rest vs. data in motion |
|
|
62 | (1) |
|
|
62 | (2) |
|
|
64 | (3) |
|
|
67 | (2) |
|
4.2 Key management server |
|
|
69 | (10) |
|
Kubernetes and KMS provider |
|
|
70 | (7) |
|
|
77 | (2) |
|
5 HashiCorp Vault and Kubernetes |
|
|
79 | (70) |
|
5.1 Managing application secrets using HashiCorp Vault |
|
|
80 | (14) |
|
Deploying Vault to Kubernetes |
|
|
81 | (10) |
|
Deploying an application to access Vault |
|
|
91 | (3) |
|
5.2 Kubernetes auth method |
|
|
94 | (4) |
|
Configuring Kubernetes auth |
|
|
95 | (2) |
|
Testing and validating Kubernetes auth |
|
|
97 | (1) |
|
5.3 The Vault Agent Injector |
|
|
98 | (6) |
|
Configurations to support Kubernetes Vault Agent injection |
|
|
100 | (3) |
|
Accessing cloud secrets stores |
|
|
103 | (1) |
|
6.1 The Container Storage Interface and Secrets Store CSI Driver |
|
|
104 | (12) |
|
Container Storage Interface |
|
|
104 | (2) |
|
Container Storage Interface and Kubernetes |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
108 | (1) |
|
Installing the Secrets Store CSI Driver |
|
|
109 | (2) |
|
Consuming HashiCorp Vault secrets via the Secrets Store CSI Driver and the HashiCorp Vault provider |
|
|
111 | (5) |
|
6.2 Synchronizing CSI secrets as Kubernetes Secrets |
|
|
116 | (5) |
|
|
117 | (1) |
|
Defining a SecretProviderClass resource with secretObjects |
|
|
117 | (4) |
|
6.3 Autorotating secrets to improve security posture |
|
|
121 | (5) |
|
|
122 | (3) |
|
Deploying the Pod with a secret mounted |
|
|
125 | (1) |
|
|
126 | (1) |
|
6.4 Consuming secrets from cloud secrets stores |
|
|
126 | (23) |
|
|
127 | (8) |
|
|
135 | (8) |
|
|
143 | (6) |
|
PART 3 Continuous integration and continuous delivery |
|
|
149 | (52) |
|
7 Kubernetes-native continuous integration and Secrets |
|
|
151 | (23) |
|
7.1 Introduction to continuous integration |
|
|
152 | (1) |
|
|
153 | (10) |
|
|
154 | (2) |
|
|
156 | (1) |
|
|
157 | (6) |
|
7.3 Continuous integration for a welcome message |
|
|
163 | (11) |
|
Compiling and Running tests |
|
|
166 | (1) |
|
Building and Pushing the container image |
|
|
166 | (2) |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (4) |
|
8 Kubernetes-native continuous delivery and Secrets |
|
|
174 | (27) |
|
8.1 Introduction to continuous delivery and deployment |
|
|
175 | (1) |
|
8.2 Continuous delivery for the welcome message |
|
|
176 | (3) |
|
Deploying the Name Generator service |
|
|
176 | (2) |
|
|
178 | (1) |
|
|
179 | (22) |
|
|
180 | (2) |
|
Welcome service and GitOps |
|
|
182 | (4) |
|
Creating a Welcome Message service from a Git repository |
|
|
186 | (4) |
|
Updating the Welcome service |
|
|
190 | (11) |
Appendix A Tooling |
|
201 | (6) |
Appendix B Installing and configuringyq |
|
207 | (3) |
Appendix C Installing and configuring pip |
|
210 | (3) |
Appendix D Installing and configuring Git |
|
213 | (3) |
Appendix E Installing GPG |
|
216 | (3) |
Index |
|
219 | |