[Lab Notes] Kubernetes the Hard Way, For Real This Time (Step 06)

Continuing my Kubernetes the Hard Way homelab build. Steps 01-05 are already done, this covers step 06.

Original guide: 06-data-encryption-keys.md

Thoughts I had while doing this

This step was pretty straightforward, just generate an encryption key and an encryption config file. But it did make me think back to step 04, where I set up the TLS/CA cert. Aren't both steps just "setting up encryption"? Kind of, but the difference is where the encryption applies:

• Step 04 (TLS/CA) secures data in transit - traffic moving between Kubernetes components over the network.
• Step 06 (encryption key) secures data at rest - specifically, Secrets stored in etcd(its like the db of kubernetes), so they're not sitting there in plain text on disk.

The encryption key

root@luger-VirtualBox:~/kubernetes-the-hard-way# export ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64)

The encryption config file

root@luger-VirtualBox:~/kubernetes-the-hard-way# envsubst < configs/encryption-config.yaml \
  > encryption-config.yaml
root@luger-VirtualBox:~/kubernetes-the-hard-way# scp encryption-config.yaml root@server:~/
encryption-config.yaml

Summary

Generated a random 32-byte encryption key and used it to fill in encryption-config.yaml, then copied that config to the controller. This is what encrypts Kubernetes Secrets at rest in etcd - separate from the TLS setup in step 04, which only covers data in transit.