{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11937","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11937/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11937/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11937/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/11937","id":97767954,"number":11937,"title":"Document how Secrets are stored and how to secure them","user":{"login":"jonmoter","id":1056506,"avatar_url":"https://avatars.githubusercontent.com/u/1056506?v=3","gravatar_id":"","url":"https://api.github.com/users/jonmoter","html_url":"https://github.com/jonmoter","followers_url":"https://api.github.com/users/jonmoter/followers","following_url":"https://api.github.com/users/jonmoter/following{/other_user}","gists_url":"https://api.github.com/users/jonmoter/gists{/gist_id}","starred_url":"https://api.github.com/users/jonmoter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonmoter/subscriptions","organizations_url":"https://api.github.com/users/jonmoter/orgs","repos_url":"https://api.github.com/users/jonmoter/repos","events_url":"https://api.github.com/users/jonmoter/events{/privacy}","received_events_url":"https://api.github.com/users/jonmoter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-28T18:17:49Z","updated_at":"2015-07-29T12:02:47Z","closed_at":null,"body":"For purposes of security and compliance, it's important to my organization to understand how sensitive information is stored, and what the attack vectors are for someone to compromise the secrets.\r\n\r\nIn the current documentation, it doesn't make any mention of where Secrets are stored at rest. Are they in etcd? Are they stored in plaintext, or are they encrypted?  If they're encrypted, where does the key live?\r\n\r\nIn other words, if I was an attacker trying to gain access to the Secrets stored in kubernetes, how could I read them and/or change them?  Also, what best practices should an admin put in place to block an attacker?"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/125930700","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/11937#issuecomment-125930700","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11937","id":125930700,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T12:02:47Z","updated_at":"2015-07-29T12:02:47Z","body":"> default policy for default service account to not be able to read any secrets (@liggitt @deads2k how do you treat this on openshift?)\r\n\r\nFor authorization purposes in openshift, service accounts are treated as a normal user.  This means that a service account has no privileges by default.  Openshift authorization rules can be scoped to namespaces and we suggest granting some privileges to certain service accounts, but we do not force them.  In particular, \r\n 1. GET access to image streams (openshift concept that allows you to name images in the local docker registry) in your namespace for all service accounts in the namespace\r\n 1. UPDATE access to image streams in your namespace for your builder service account\r\n 1. GET/UPDATE for RCs and Pods in your namespace for your deployer service account\r\n\r\nWe provide project templates that provide our recommended role bindings."}}