Enhancing Kubernetes Security with External Secrets Operator (ESO)

By /

Listen to this Post

Featured Image

Introduction

Managing secrets securely in Kubernetes is critical to preventing unauthorized access and maintaining compliance. While Kubernetes offers native secrets, they lack advanced features like automatic rotation and centralized auditing. The External Secrets Operator (ESO) bridges this gap by integrating with dedicated secret management services such as AWS Secrets Manager.

Learning Objectives

  • Understand why native Kubernetes secrets are insufficient for enterprise security.
  • Learn how ESO integrates with AWS Secrets Manager for centralized secret management.
  • Implement ESO in a Kubernetes cluster for secure secret retrieval.

You Should Know

1. Why Native Kubernetes Secrets Fall Short

Kubernetes secrets are base64-encoded but not encrypted by default, making them vulnerable if accessed improperly.

Command to view a Kubernetes secret:

kubectl get secrets <secret-name> -o yaml

Steps:

1. Retrieve the secret in YAML format.

2. Decode the base64-encoded data:

echo "<encoded-data>" | base64 --decode

This exposes the raw secret, highlighting the need for better security measures.

2. Setting Up External Secrets Operator (ESO)

ESO fetches secrets from AWS Secrets Manager and injects them into Kubernetes as native secrets.

Install ESO using Helm:

helm repo add external-secrets https://charts.external-secrets.io 
helm install external-secrets external-secrets/external-secrets -n external-secrets --create-namespace

Steps:

1. Add the ESO Helm repository.

2. Install ESO in a dedicated namespace.

3. Configuring AWS Secrets Manager Integration

Link ESO to AWS Secrets Manager using IAM roles and policies.

Create an IAM policy for secret access:

{ 
"Version": "2012-10-17", 
"Statement": [ 
{ 
"Effect": "Allow", 
"Action": "secretsmanager:GetSecretValue", 
"Resource": "" 
} 
] 
}

Steps:

1. Attach this policy to an IAM role.

2. Configure Kubernetes ServiceAccount to assume the role.

4. Creating an ExternalSecret Resource

Define an `ExternalSecret` to fetch secrets from AWS.

Example YAML:

apiVersion: external-secrets.io/v1beta1 
kind: ExternalSecret 
metadata: 
name: aws-secret 
spec: 
refreshInterval: 1h 
secretStoreRef: 
name: aws-secret-store 
kind: SecretStore 
target: 
name: kubernetes-secret 
data: 
- secretKey: database-password 
remoteRef: 
key: /prod/db/password

Steps:

  1. Apply this manifest to sync AWS secrets into Kubernetes.

2. Verify with `kubectl get secrets`.

5. Automating Secret Rotation

AWS Secrets Manager supports automatic rotation, which ESO can leverage.

Enable rotation for a secret:

aws secretsmanager rotate-secret --secret-id /prod/db/password --rotation-rules AutomaticallyAfterDays=30

Steps:

1. Set a rotation schedule in AWS.

  1. ESO automatically updates Kubernetes secrets when changes occur.

6. Auditing Secret Access

Track who accesses secrets using AWS CloudTrail.

Query CloudTrail logs:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue

Steps:

1. Monitor API calls to Secrets Manager.

2. Alert on suspicious access patterns.

7. Hardening ESO Security

Restrict ESO permissions using IAM conditions.

Example IAM condition:

"Condition": { 
"StringEquals": { 
"secretsmanager:ResourceTag/Environment": "prod" 
} 
}

Steps:

1. Tag secrets by environment.

2. Limit ESO to only access production secrets.

What Undercode Say

  • Centralized secret management reduces risk by eliminating scattered credentials.
  • Automated rotation and auditing ensure compliance with security policies.

Analysis:

ESO significantly improves Kubernetes security by integrating with enterprise-grade secret managers. While native secrets are convenient, they lack robust security features. By adopting ESO, organizations gain centralized control, rotation capabilities, and detailed audit logs—essential for meeting regulatory requirements like GDPR and HIPAA. Future developments may include multi-cloud secret synchronization and tighter integration with CI/CD pipelines.

For a detailed guide, refer to Ritik Kesharwani’s article.

IT/Security Reporter URL:

Reported By: Darryl Ruggles – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: