{"componentChunkName":"component---node-modules-gatsby-theme-apollo-docs-src-components-template-js","path":"/security/risk-assessments/","result":{"data":{"site":{"pathPrefix":"","siteMetadata":{"title":"akv2k8s docs","description":"How to get Azure Key Vault objects into Kubernetes"}},"file":{"childMarkdownRemark":{"frontmatter":{"title":"Risk Assessments","description":"Learn about the risk assessments the akv2k8s project has done"},"headings":[{"value":"How to handle credentials"}],"fields":{"image":"social-cards/risk-assessments.png","graphManagerUrl":""},"htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"To help assess if the akv2k8s project is within the risk thresholds here is a list of some of the perticulars and the risk assessments we did around those topics."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"When developing the akv2k8s project there are many"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{"id":"how-to-handle-credentials","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#how-to-handle-credentials","ariaLabel":"how to handle credentials permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"How to handle credentials"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Credentials to Azure Key Vault is needed by both the controller that syncs AKV secrets into Kubernetes secrets, and the env-injector that inject AKV secrets into container applications."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{"id":"the-controller","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#the-controller","ariaLabel":"the controller permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"The Controller"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The controller is the easiest to evaluate, as it's not directly exposed together with the applications using them. It's a centrally installed component that can be secured using RBAC mechanisms in Kubernetes and prevent everyone except admins access to any secrets, in perticular the AKV credentials the controller needs. The risk of exposing credentials to uninvited guests is low, and no higher than any other components in Kubernetes handling sensitive data. In practice, the same security precautions must be taken as with Kubernetes Secrets in general. The Kubernetes project have documented this here:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{"id":"the-env-injector","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#the-env-injector","ariaLabel":"the env injector permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"The Env-Injector"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Compared to the Controller the injector is quite different, as it's directly exposed together with the Pod and Containers requesting secret injection. In practice this means the code that downloads the secrets for Azure Key Vault runs inside the application Container and are executed before the original executable of that container. After the container has started, a Kubernetes user with the right credentials are able to exec into the container. Several steps have been taken to avoid exposing sensitive data in this scenario and are explained below. Another scenario is data stored in Kubernetes Secrets"}]}],"data":{"quirksMode":false}}},"childMdx":null}},"pageContext":{"id":"ce0c328b-01c5-5605-9629-918b9734fa18","subtitle":"","versionDifference":0,"versionBasePath":"/v1.8-wip","sidebarContents":[{"title":null,"pages":[{"title":"Overview","sidebarTitle":"","description":"Explore Azure Key Vault to Kubernetes","path":"/"},{"title":"Why use akv2k8s?","sidebarTitle":"","description":null,"path":"/why-akv2k8s/"},{"title":"Quick Start","sidebarTitle":"","description":"Quickly get started using Azure Key Vault to Kubernetes","path":"/quick-start/"},{"title":"How it Works","sidebarTitle":"","description":"Learn about the inner workings of akv2k8s.","path":"/how-it-works/"},{"title":"FAQ","sidebarTitle":"","description":"Most frequently asked questions","path":"/faq/"}]},{"title":"Installation","pages":[{"title":"Overview","sidebarTitle":"","description":"Different options for installing akv2k8s","path":"/installation/"},{"title":"Requirements","sidebarTitle":"","description":"Requirements for installing akv2k8s","path":"/installation/requirements/"},{"title":"Installing on Azure AKS","sidebarTitle":"","description":"How to install Azure Key Vault to Kubernetes (akv2k8s) on Azure AKS","path":"/installation/on-azure-aks/"},{"title":"Installing outside Azure AKS","sidebarTitle":"","description":"Learn how to install Azure Key Vault to Kubernetes outside Azure AKS","path":"/installation/outside-azure-aks/"},{"title":"Updating akv2k8s CRDs","sidebarTitle":"","description":"How to update akv2k8s Custom Resource Definitions (CRDs)","path":"/installation/crd/"},{"title":"Installation without Helm","sidebarTitle":"","description":"How to setup Azure Key Vault to Kubernetes","path":"/installation/without-helm/"},{"title":"Upgrade","sidebarTitle":"","description":"How to upgrade Azure Key Vault to Kubernetes","path":"/installation/upgrade/"},{"title":"Installing with Azure Workload Identity","sidebarTitle":"","description":"Learn how to run akv2k8s with Azure Workload Identity","path":"/installation/with-azure-workload-identity/"}]},{"title":"Tutorials","pages":[{"title":"Tutorials","sidebarTitle":"","description":"A quick introduction to the tutorials","path":"/tutorials/"},{"title":"Prerequisites","sidebarTitle":"","description":"A quick overview of the prerequisites needed to complete the tutorials","path":"/tutorials/prerequisites/"},{"title":"Sync Secret","sidebarTitle":"","description":"Sync a secret from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/1-secret/"},{"title":"Sync Certificate","sidebarTitle":"","description":"Sync a certificate from Azure Key Vault into a Kubernetes Secret.","path":"/tutorials/sync/2-certificate/"},{"title":"Sync Signing Key","sidebarTitle":"","description":"Sync signing key from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/3-signing-key/"},{"title":"Sync Multi Key Value Secret","sidebarTitle":"","description":"Sync a multi-key-value secret from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/4-multi-key-value-secret/"},{"title":"Sync Multiple AKVS to One Secret","sidebarTitle":"","description":"Sync multiple AzureKeyVaultSecrets to a single Kubernetes Secret","path":"/tutorials/sync/5-multi-akvs-to-one-secret/"},{"title":"Sync Secret to ConfigMap","sidebarTitle":"","description":"Sync a secret from Azure Key Vault into a Kubernetes ConfigMap","path":"/tutorials/sync/6-secret-to-configmap/"},{"title":"Sync with Namespace Isolation of Controller","sidebarTitle":"","description":"Isolate Akv2k8s Controller to a specific namespace.","path":"/tutorials/sync/7-namespace-isolation-of-controller/"},{"title":"Sync Objects Based on Labels","sidebarTitle":"","description":"How to sync objects based on label selectors","path":"/tutorials/sync/8-label-filtered-syncing/"},{"title":"Sync PFX Certificate Stored as Secret","sidebarTitle":"","description":"Sync a certificate stored as secret from Azure Key Vault into a kubernetes.io/tls Kubernetes secret.","path":"/tutorials/sync/9-certificate-as-AKV-secret/"},{"title":"Inject Secret","sidebarTitle":"","description":"Inject an Azure Key Vault secret directly into a container application","path":"/tutorials/env-injection/1-secret/"},{"title":"Inject Certificate","sidebarTitle":"","description":"Inject an Azure Key Vault certificate key pair directly into a container application","path":"/tutorials/env-injection/2-certificate/"},{"title":"Inject Signing Key","sidebarTitle":"","description":"Inject a signing key from Azure Key Vault as environment variable into an application","path":"/tutorials/env-injection/3-signing-key/"},{"title":"Inject PFX Certificate","sidebarTitle":"","description":"Inject a PFX certificate from Azure Key Vault as environment variables into an application","path":"/tutorials/env-injection/5-pfx-certificate/"}]},{"title":"Security","pages":[{"title":"Authentication with Azure Key Vault","sidebarTitle":"","description":"Learn about the different options for authenticating with Azure Key Vault.","path":"/security/authentication/"},{"title":"Authorization","sidebarTitle":"","description":"Learn how to set the proper access rights in Azure Key Vault","path":"/security/authorization/"},{"title":"Enable Environment Injecton","sidebarTitle":"","description":"Learn how to enable environment injection per Kubernetes namespace","path":"/security/enable-env-injection/"},{"title":"Risk Assessments","sidebarTitle":"","description":"Learn about the risk assessments the akv2k8s project has done","path":"/security/risk-assessments/"},{"title":"Supply chain verification","sidebarTitle":"","description":"Verify akv2k8s release images, attestations, and SBOMs","path":"/security/supply-chain/"}]},{"title":"Monitoring","pages":[{"title":"Logs","sidebarTitle":"","description":"Akv2k8s logs","path":"/monitoring/logs/"},{"title":"Metrics","sidebarTitle":"","description":"Akv2k8s metrics","path":"/monitoring/metrics/"}]},{"title":"Troubleshooting","pages":[{"title":"Get the akv2k8s Controller Log","sidebarTitle":"","description":"How to access the Controller log and specify log level","path":"/troubleshooting/controller-log/"},{"title":"Set env-injector log-level","sidebarTitle":"","description":"How to set the log-level for the env-injector","path":"/troubleshooting/env-injector-log-level/"},{"title":"Known Issues","sidebarTitle":"","description":"A list of known issues and available solutions or workarounds","path":"/troubleshooting/known-issues/"}]},{"title":"Reference","pages":[{"title":"AzureKeyVaultSecret","sidebarTitle":"","description":"Reference of AzureKeyVaultSecret custom resource definition","path":"/reference/azure-key-vault-secret/"},{"title":"Runtime configuration","sidebarTitle":"","description":"Runtime flags and environment variables supported by akv2k8s components","path":"/reference/runtime-configuration/"},{"title":"Changelog","sidebarTitle":"","description":"Functional changes in akv2k8s releases","path":"/reference/changelog/"}]}],"githubUrl":"https://github.com/sparebankenvest/akv2k8s-website/tree/master/source/content/security/risk-assessments.md","spectrumUrl":"","twitterHandle":"","versions":["1.5-dev","1.4","1.3","1.2","1.1","1.0"],"defaultVersion":"1.8-wip","baseUrl":"https://akv2k8s.io"}},"staticQueryHashes":["1511030359","2468095761","2468095761","426988268","426988268"]}