trousseau.io

while there are significant efforts to improve kubernetes component layers, the state of secret management is not receiving much interests. using etcd to store api object definition & states, kubernetes secrets are encoded in base64 and shipped into the key value store database. even if the filesystems on which etcd runs are encrypted, the secrets are still not. to solve this design flaw, both commercial and open source solutions exist leveraging different approaches to handle secrets calling for a different set of tools or practices instead of leveraging the native kubernetes way to manage secrets. this leads to training and maintaining niche skills and tooling set increasing cost and complexity of kubernetes day 2 operations. with trousseau, any user/workload can leverage the native kubernetes way to store and access secrets in a safe way by plugin to any key management service (kms) provider using the kubernetes kms pluging framework.