K8s secrets encrypted keys managed remediation

Using Console

Using CLI

To remediate the misconfiguration of Kubernetes Secrets not being encrypted using KMS Keys on GCP, you can follow the below steps:

Open the Cloud Shell in the GCP Console.
Run the following command to get the list of Kubernetes secrets in the cluster:
```
kubectl get secrets
```
Identify the secrets that are not encrypted using KMS keys.

Create a KMS keyring and key:

gcloud kms keyrings create [KEYRING-NAME] --location [LOCATION]

gcloud kms keys create [KEY-NAME] --location [LOCATION] --keyring [KEYRING-NAME] --purpose encryption

Replace [KEYRING-NAME], [LOCATION] and [KEY-NAME] with the appropriate values.

Encrypt the Kubernetes secrets using the KMS key:
```
gcloud kms encrypt --key [KEY-NAME] --keyring [KEYRING-NAME] --location [LOCATION] --plaintext-file [SECRET-FILE-PATH] --ciphertext-file [ENCRYPTED-FILE-PATH]
```
Replace [KEYRING-NAME], [LOCATION], [KEY-NAME], [SECRET-FILE-PATH] and [ENCRYPTED-FILE-PATH] with the appropriate values.
Update the Kubernetes secrets with the encrypted data:
```
kubectl create secret generic [SECRET-NAME] --from-file=[SECRET-FILE-PATH]=[ENCRYPTED-FILE-PATH]
```
Replace [SECRET-NAME], [SECRET-FILE-PATH] and [ENCRYPTED-FILE-PATH] with the appropriate values.
Verify that the secrets have been encrypted using KMS keys:
```
kubectl get secrets
kubectl describe secret [SECRET-NAME]
```
Replace [SECRET-NAME] with the name of the secret.
Delete the unencrypted Kubernetes secrets:
```
kubectl delete secret [SECRET-NAME]
```
Replace [SECRET-NAME] with the name of the secret.

By following these steps, you can ensure that the Kubernetes secrets are encrypted using KMS keys on GCP.

Using Python

To remediate the misconfiguration of ensuring Kubernetes secrets are encrypted using KMS keys in GCP using Python, you can follow the below steps:

Install the necessary Python libraries:
- google-auth
- google-auth-oauthlib
- google-auth-httplib2
- google-cloud-kms
- kubernetes

Authenticate with GCP using a service account key file:

from google.oauth2 import service_account
credentials = service_account.Credentials.from_service_account_file('key.json')

Connect to the KMS service:

from google.cloud import kms_v1
kms_client = kms_v1.KeyManagementServiceClient(credentials=credentials)

Get the KMS key resource name:

key_name = kms_client.crypto_key_path_path('project-id', 'location', 'key-ring', 'key')

Retrieve the Kubernetes secret:

from kubernetes import client, config
config.load_kube_config()
v1 = client.CoreV1Api()
secret = v1.read_namespaced_secret('secret-name', 'namespace')

Encrypt the secret data using the KMS key:

from google.cloud import kms_v1
plaintext = secret.data['key']
response = kms_client.encrypt(key_name, plaintext.encode('utf-8'))

Update the Kubernetes secret with the encrypted data:

secret.data['key'] = response.ciphertext
v1.replace_namespaced_secret('secret-name', 'namespace', secret)

By following these steps, you can ensure that Kubernetes secrets are encrypted using KMS keys in GCP using Python.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

K8s secrets encrypted keys managed remediation

Triage and Remediation

Remediation

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

​Triage and Remediation

​Remediation

Triage and Remediation

Remediation