Book Image

Hands-on Kubernetes on Azure, Third Edition - Third Edition

By : Nills Franssens, Shivakumar Gopalakrishnan, Gunther Lenz
Book Image

Hands-on Kubernetes on Azure, Third Edition - Third Edition

By: Nills Franssens, Shivakumar Gopalakrishnan, Gunther Lenz

Overview of this book

Containers and Kubernetes containers facilitate cloud deployments and application development by enabling efficient versioning with improved security and portability. With updated chapters on role-based access control, pod identity, storing secrets, and network security in AKS, this third edition begins by introducing you to containers, Kubernetes, and Azure Kubernetes Service (AKS), and guides you through deploying an AKS cluster in different ways. You will then delve into the specifics of Kubernetes by deploying a sample guestbook application on AKS and installing complex Kubernetes apps using Helm. With the help of real-world examples, you'll also get to grips with scaling your applications and clusters. As you advance, you'll learn how to overcome common challenges in AKS and secure your applications with HTTPS. You will also learn how to secure your clusters and applications in a dedicated section on security. In the final section, you’ll learn about advanced integrations, which give you the ability to create Azure databases and run serverless functions on AKS as well as the ability to integrate AKS with a continuous integration and continuous delivery (CI/CD) pipeline using GitHub Actions. By the end of this Kubernetes book, you will be proficient in deploying containerized workloads on Microsoft Azure with minimal management overhead.
Table of Contents (22 chapters)
1
Foreword
Free Chapter
2
Section 1: The Basics
5
Section 2: Deploying on AKS
11
Section 3: Securing your AKS cluster and workloads
16
Section 4: Integrating with Azure managed services
21
Index

Different secret types in Kubernetes

As mentioned in the introduction to this chapter, Kubernetes comes with a default secrets implementation. This default implementation will store secrets in the etcd database that Kubernetes uses to store all object metadata. When Kubernetes stores secrets in etcd, it will store them in base64-encoded format. Base64 is a way to encode data in an obfuscated manner but is not a secure way of doing encryption. Anybody with access to base64-encoded data can easily decode it. AKS adds a layer of security on top of this by encrypting all data at rest within the Azure platform.

The default secret implementation in Kubernetes allows you to store multiple types of Secrets:

  • Opaque secrets: These can contain any arbitrary user-defined secret or data.
  • Service account tokens: These are used by Kubernetes pods for built-in cluster RBAC.
  • Docker config secrets: These are used to store Docker registry credentials for Docker command-line configuration...