wrongsecrets
wrongsecrets copied to clipboard
OWASP
Sealed Secret in Kubernetes
In the repository would be committed file containing Sealed Secret e.g.:
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: mysecret
namespace: mynamespace
spec:
encryptedData:
foo: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq.....
Sealed Secret is asymmetrically encrypted and only the Sealed Secret Controller deployed in Kubernetes can decrypt it. Such decrypted secrets "unsealed" are stored as classic Kubernetes secret.
apiVersion: v1
kind: Secret
metadata:
name: mysecret
namespace: mynamespace
data:
foo: YmFy # <- base64 encoded "bar"
@commjoen could you describe proposed on Slack attack vector?
We would get into trouble if the private key is somehow compromised: either by specifying a backup key to use teh secret without the controler or by having the secret accessible due to an RBAC misconfiguration. However: i have not seen any of the 2 cases alive yet. @bendehaan : what should we do here?
One of the challenges would still be: how can we implement this in ctf-party? should the controler live in a namespace everyone has access to?
As agreed with @bendehaan :We can implement it for now using a controller with an exposed private key. Assigning this one to you @MarcinNowak-codes
@commjoen I can't recall I was assignee earlier, shouldn't it be @drnow4u?
@commjoen has some discussion already done on slack about this issue ?? i wanted some more details on this
@Shubham-Patel07 can you, before taking on this issue, first fix the other 2 outstanding PRs please?
Missing unit tests and textual corrections. Good to know: @Shubham-Patel07 given current RBAC, we could add the hints of accessing the secret directly, meaning all can be done in the same challenge ;-)
Updated https://github.com/OWASP/wrongsecrets/pull/1521 to have both cahllenges combined in this one.