Security, cost and GPUs
Secrets management and encryption
Keeping credentials out of code and data safe at rest and in transit with KMS, Vault and envelope encryption — plus how to catch leaks before they become incidents.
Encryption protects data when a disk is stolen or traffic is sniffed. Secrets management protects the keys and passwords that unlock that data. Both fail in the same way: the secret leaves the place that can audit and rotate it. This topic ties crypto basics and IAM together.
Concepts in reading order
| Step | Concept | What it answers |
|---|---|---|
| 1 | Secret lifecycle | What happens to a secret from creation to audit? |
| 2 | Where secrets live | Which store fits, and why is a Kubernetes Secret not enough? |
| 3 | Envelope encryption | How do you encrypt large data with a key service? |
| 4 | Rotation without outages | How do you replace a secret without breaking consumers? |
| 5 | Leak response | What do you do when a secret escapes? |
Start with step 1. Steps 2 to 5 assume you know the lifecycle.
Threat model in one table
Before you pick tools, write down what you are defending against.
| Threat | Control |
|---|---|
| Engineer commits a key | Pre-commit and CI secret scans, push protection |
| Compromised app process | Least-privilege identity, short-lived dynamic secrets |
| Stolen laptop or phished SSO | MFA, short sessions, device trust |
| Disk stolen from an availability zone | Volume and object encryption with KMS keys |
| Passive sniffing on the network | TLS or mTLS, no plaintext admin APIs |
| Malicious insider with broad IAM | Dual control for key admins, audit every decrypt |
Encryption at rest is not enough on its own. A stolen IAM role can still read everything it is allowed to. Your secrets are only as strong as the IAM around decrypt and secret reads.
Encryption in transit
TLS protects traffic from clients to services. Inside a data center, plaintext HTTP between services is common and still wrong for sensitive data. A service mesh with mutual TLS (Istio, Linkerd or Cilium) gives each workload a certificate. Unauthorized pods then cannot speak the protocol, even on the same network.
mTLS does not replace IAM on data stores. It stops impersonation and casual packet capture. You still need authorization.
Common mistakes
- Assuming Kubernetes Secrets are encrypted. They are encoded unless etcd encryption is on.
- Committing secrets to git, even briefly. History keeps them.
- Falling back to a built-in default when the secret store is down. Fail closed instead. Redact secrets in logs.
Key takeaways
- Secrets need a full lifecycle: create, distribute, use, rotate, revoke, audit.
- Prefer a managed store or Vault. Prefer dynamic secrets when the system can mint them.
- Envelope encryption keeps master keys in KMS and encrypts data locally, which is fast.
- Scan at commit time, in CI and across history. On a leak, rotate first.
Further learning
OWASP's Top 10 is the shared list of application risks. Many of the controls on this page are the platform side of those risks.
OWASP Top 10The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software…OWASP Foundation
For interviews, be ready to draw envelope encryption, explain why Kubernetes Secrets alone are not enough, compare static and dynamic secrets with a TTL example, and describe a dual-read rotation with no downtime.
Related
Cryptography for engineers
The few building blocks you need for everyday security decisions, which question each one answers, and where teams go wrong. Start here for the map.
IAM and least privilege
How cloud identity works, why least privilege is a habit rather than a checkbox, and where the org-level guardrails sit. Start here for the map of IAM pages.
Continuous integration and the software supply chain
Fast, trustworthy pipelines - build, test, artifact, scan and sign - plus DORA metrics and supply-chain controls that keep trunk green.