시크릿 관리 심화 — etcd 암호화부터 External Secrets Operator까지

# Secret 값 쉽게 확인 가능
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d
# p@ssw0rd

# /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      # 암호화 프로바이더 (우선순위 순)
      - aescbc:
          keys:
            - name: key1
              secret: <base64로 인코딩된 32바이트 키>
      # identity는 암호화 안 함 — 기존 데이터 읽기용
      - identity: {}

# 암호화 키 생성
head -c 32 /dev/urandom | base64

# API Server 설정에 추가
# kube-apiserver 실행 옵션:
# --encryption-provider-config=/etc/kubernetes/encryption-config.yaml

providers:
  - kms:
      apiVersion: v2
      name: aws-kms
      endpoint: unix:///var/run/kmsplugin/socket.sock

# 모든 Secret 재암호화
kubectl get secrets --all-namespaces -o json | kubectl replace -f -

# ESO 설치
helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace

# SecretStore — 외부 소스 연결 설정
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secrets
  namespace: production
spec:
  provider:
    aws:
      service: SecretsManager
      region: ap-northeast-2
      auth:
        jwt:
          serviceAccountRef:
            name: eso-sa
---
# ExternalSecret — 동기화 규칙
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  refreshInterval: 1h          # 1시간마다 동기화
  secretStoreRef:
    name: aws-secrets
    kind: SecretStore
  target:
    name: db-credentials       # 생성될 Kubernetes Secret 이름
    creationPolicy: Owner
  data:
    - secretKey: username      # Kubernetes Secret의 키
      remoteRef:
        key: production/db     # AWS Secrets Manager의 시크릿 이름
        property: username     # JSON 속성
    - secretKey: password
      remoteRef:
        key: production/db
        property: password

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: "https://vault.example.com"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "app-role"
          serviceAccountRef:
            name: vault-sa

# 컨트롤러 설치
helm install sealed-secrets sealed-secrets/sealed-secrets \
  --namespace kube-system

# kubeseal CLI로 Secret 암호화
kubectl create secret generic db-secret \
  --from-literal=password=p@ssw0rd \
  --dry-run=client -o yaml | \
  kubeseal --format yaml > sealed-secret.yaml

# sealed-secret.yaml — Git에 커밋해도 안전
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-secret
  namespace: production
spec:
  encryptedData:
    password: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...

# Secret 접근 감사 로그 활성화
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    resources:
      - group: ""
        resources: ["secrets"]

# Secret을 사용하는 Pod 확인
kubectl get pods --all-namespaces -o json | \
  jq '.items[] | select(.spec.volumes[]?.secret) | .metadata.name'

# 불필요한 Secret 정리
kubectl get secrets --all-namespaces --no-headers | wc -l