Amazon EKS — Secrets Management

1 minute read

Secrets Management

Kubernetes Secrets store sensitive data like passwords, API keys, and TLS certificates. On EKS, you can integrate with AWS Secrets Manager for enhanced security.

Three Approaches

Method Security Complexity
K8s Secrets (base64) Low (not encrypted by default) Low
K8s Secrets + KMS encryption Medium Low
AWS Secrets Manager + CSI driver High Medium

Kubernetes Secrets (Basic)

# Create secret
$ kubectl create secret generic db-creds \
    --from-literal=username=admin \
    --from-literal=password=SuperSecret123

# Use in pod

env:
  - name: DB_USER
    valueFrom:
      secretKeyRef:
        name: db-creds
        key: username
  - name: DB_PASS
    valueFrom:
      secretKeyRef:
        name: db-creds
        key: password

Warning: K8s Secrets are base64-encoded, NOT encrypted. Anyone with API access can decode them.

AWS Secrets Manager + CSI Driver

The Secrets Store CSI driver mounts AWS secrets as files in pods:

# Install CSI driver
$ helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
$ helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver \
    --namespace kube-system \
    --set syncSecret.enabled=true

# Install AWS provider
$ kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/deployment/aws-provider-installer.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secrets
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "prod/db-password"
        objectType: "secretsmanager"
---
apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  serviceAccountName: secrets-reader    # IRSA with SecretsManager access
  containers:
    - name: app
      image: my-app
      volumeMounts:
        - name: secrets
          mountPath: /mnt/secrets
          readOnly: true
  volumes:
    - name: secrets
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: aws-secrets

Common Mistakes

Mistake Impact
Secrets in Git (even base64) Credentials exposed in version control
Not enabling KMS envelope encryption Secrets readable from etcd
Hardcoded credentials in container images Credentials baked into artifact
Not rotating secrets Stale credentials, compliance risk

What’s Next?

Comprehensive security: Security Best Practices.

You may also enjoy