Hacker News Reader

Comment by MadsRC | Hacker News Reader

  In Kubernetes, secrets are base64 encoded, so they are quite secure.

I’m sorry, but what the actual f&$/… I‘s expect better from RedHat. In what world does storing a secret as base64 warrant calling it “quite secure”?

The only protection I can think of is:

* The occasional glance at your screen.

* Injection attack (to some degree)

View on HN

I think the main reason for base64 encoding is to allow you to store binary data into a secret. Not a security measure. The kubernetes docs say as much: https://kubernetes.io/docs/concepts/configuration/secret/

Can confirm this is why we did it. Very confused to see Red Hat claim that Base64 was a security thing.

I’m pretty sure the author just wasn’t as familiar with the topic as they should have been. Should have been caught during editing though.

As Joe notes, this was just how you most easily encode binary data in JSON. We did discuss that the encoding has a minor benefit to “over the shoulder reader” obscurity, but that wasn’t the goal.

It is true, in configmap objects you can not store binary data.

You can always add 3rot13 on top of it for extra security.

Sounds like the marketing department participated in writing the docs this time.

FWIW, this site is not a corporate blog, but a community encouraging current and aspiring sysadmins to learn in public. The author is not an official spokesperson and is very new. Also, I should have caught this point before hitting publish, so it's my bad.

And if it's not obvious: Red Hat wrote enough of Kubernetes to know better than to base64 anything of value.

You should make this much more clear. There seems to be absolutely no indication on this page that this isn't officially endorsed content.

You're absolutely right. I'm working on an update now and hoping it rolls into prod this week.

Reply on news.ycombinator.com