Keep secrets safe (secrets, crypto and identity)

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Secrets, crypto en identiteit — 6

Vault — the secret store

vault stores secrets encrypted, gives them only after login and policy checks, and can create short-lived database and cloud credentials.

Used for: app secrets in Kubernetes (agent injector, Secrets Operator, External Secrets), dynamic DB users, a private CA (PKI), encryption as a service (transit).

$vault status
$vault kv put -mount=secret shop/db username=shop password='S3cr3t!x'
$vault kv get -mount=secret -field=password shop/db
$vault policy write shop-read shop-read.hcl

Security checklist:

Revoke the root token after setup; unseal keys with different people or cloud auto-unseal.
Turn on the audit log; short TTLs for tokens and leases.
In Azure, Key Vault does the same job for most teams.

6.2

OpenSSL — certificates and TLS checks

openssl makes keys and CSRs, reads certificates, tests TLS servers and makes random secrets.

$openssl req -new -newkey rsa:3072 -nodes -keyout shop.key -out shop.csr -subj "/CN=shop.example.com" -addext "subjectAltName=DNS:shop.example.com"
$echo | openssl s_client -connect shop.example.com:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -dates
$openssl rand -base64 24

Security checklist:

Private keys 600, never in tickets or chats.
Always add subjectAltName; follow the system crypto policy.

6.3

SOPS — encrypted secrets in Git

sops encrypts only the values in YAML/JSON/ENV files (with age or a cloud KMS), so GitOps repos can hold secrets safely.

$sops encrypt -i k8s/db.secret.yaml
$sops k8s/db.secret.yaml
$sops decrypt k8s/db.secret.yaml | kubectl apply -f -

Security checklist:

.sops.yaml with encrypted_regex: ^(data|stringData)$.
The age private key never goes into Git; a CI check for unencrypted secrets.

6.4

age — simple file encryption

age encrypts files to public keys (or SSH keys) with tiny configs — the key type behind SOPS, also good for encrypted backups.

$age-keygen -o key.txt
$tar czf - /etc | age -r age1… > etc.tgz.age
$age -d -i key.txt etc.tgz.age | tar tzf - | head

6.5

GPG — signatures for downloads and packages

gpg verifies signed downloads and RPM packages, and signs releases and tags.

$gpg --verify terraform_1.9.8_SHA256SUMS.sig terraform_1.9.8_SHA256SUMS
$gpg --fingerprint security@hashicorp.com
#rpm -K package.rpm

Security checklist:

Compare fingerprints with a second trusted source.
Back up the secret key and a revocation certificate offline.

6.6

Keycloak — single sign-on

Keycloak gives SSO (OIDC, SAML) with MFA for apps, Grafana, Argo CD and dashboards; kcadm scripts its admin tasks.

$kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin
$kcadm.sh create realms -s realm=lab -s enabled=true -s bruteForceProtected=true
$kcadm.sh create clients -r lab -s clientId=grafana -s protocol=openid-connect -i

Security checklist:

MFA for admins; no public /admin; production mode with TLS and a database.
In Azure companies, Entra ID often plays this role.

Onthoud

The best secret is one that does not exist: use workload identity / managed identity / OIDC so apps and pipelines get short-lived tokens instead of stored passwords.

Alle commando's in dit hoofdstuk