From 006862900be7ea58b600d69d334b55ffe55a4c5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rio=20Serrador?= <61971372+mruiserrmendix@users.noreply.github.com> Date: Thu, 17 Sep 2026 09:29:10 +0200 Subject: [PATCH 1/2] Enhance Kubernetes Secrets security guidance Added security recommendations for managing Kubernetes Secrets, including encryption options and external secrets management solutions. --- .../en/docs/deployment/pad/kubernetes-pad.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/content/en/docs/deployment/pad/kubernetes-pad.md b/content/en/docs/deployment/pad/kubernetes-pad.md index 3a9af28d9e2..1643429c2bc 100644 --- a/content/en/docs/deployment/pad/kubernetes-pad.md +++ b/content/en/docs/deployment/pad/kubernetes-pad.md @@ -113,6 +113,28 @@ Store all sensitive values in a Kubernetes Secret by performing the following st Replace the name and path of the file as required. +##### Security Recommendation + +By default, Kubernetes Secrets are stored in the cluster's datastore (etcd). Although Secret values are Base64-encoded, they are not encrypted by default and anyone with sufficient access to etcd or the Kubernetes API can read them. +For production deployments, configure Encryption at Rest for Kubernetes Secrets. This ensures sensitive information such as database credentials, license keys, and administrator passwords is encrypted before it's stored in etcd. +Common approaches include: + + AWS EKS: Use AWS KMS for envelope encryption of Kubernetes Secrets. + Azure AKS: Enable Secret encryption using Azure Key Vault and a customer-managed key (CMK) or the AKS Secret encryption feature. + Google GKE: Configure Application-layer Secrets Encryption using Cloud KMS. + Self-managed Kubernetes clusters: Configure an EncryptionConfiguration file for the API server and use a supported provider such as AES-CBC, Secretbox, or an external KMS provider. + +In addition, consider storing highly sensitive credentials in an external secrets management solution such as: + + AWS Secrets Manager + Azure Key Vault + Google Secret Manager + HashiCorp Vault + +These solutions can be integrated with Kubernetes using the External Secrets Operator or the Secrets Store CSI Driver, reducing the need to store long-lived credentials directly in Kubernetes Secrets. +For environments that require strict security or compliance controls, Mendix recommends enabling Secret encryption at rest and following your organization's key management policies. + + #### Using a ConfigMap The previous section showed how to load secrets as environment variables. For other properties that need to be changed and are not defined in a secret, you can pass constants and variables using a ConfigMap by mounting them as files (similar to mounting files in Docker) and by passing them directly as environment variables. From 0bb65afe34c472ab40f99b3ea8d1da0a05c7b35e Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Thu, 17 Sep 2026 09:51:00 +0200 Subject: [PATCH 2/2] Update kubernetes-pad.md --- .../en/docs/deployment/pad/kubernetes-pad.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/content/en/docs/deployment/pad/kubernetes-pad.md b/content/en/docs/deployment/pad/kubernetes-pad.md index 1643429c2bc..1c93d78a728 100644 --- a/content/en/docs/deployment/pad/kubernetes-pad.md +++ b/content/en/docs/deployment/pad/kubernetes-pad.md @@ -113,27 +113,27 @@ Store all sensitive values in a Kubernetes Secret by performing the following st Replace the name and path of the file as required. -##### Security Recommendation +##### Security Recommendations -By default, Kubernetes Secrets are stored in the cluster's datastore (etcd). Although Secret values are Base64-encoded, they are not encrypted by default and anyone with sufficient access to etcd or the Kubernetes API can read them. -For production deployments, configure Encryption at Rest for Kubernetes Secrets. This ensures sensitive information such as database credentials, license keys, and administrator passwords is encrypted before it's stored in etcd. -Common approaches include: +By default, Kubernetes secrets are stored in the cluster's datastore (`etcd`). Although secret values are Base64-encoded, they are not encrypted by default and anyone with sufficient access to `etcd` or the Kubernetes API can read them. - AWS EKS: Use AWS KMS for envelope encryption of Kubernetes Secrets. - Azure AKS: Enable Secret encryption using Azure Key Vault and a customer-managed key (CMK) or the AKS Secret encryption feature. - Google GKE: Configure Application-layer Secrets Encryption using Cloud KMS. - Self-managed Kubernetes clusters: Configure an EncryptionConfiguration file for the API server and use a supported provider such as AES-CBC, Secretbox, or an external KMS provider. +For production deployments, configure Encryption at Rest for Kubernetes Secrets. This ensures that sensitive information such as database credentials, license keys, and administrator passwords is encrypted before it is stored in `etcd`. -In addition, consider storing highly sensitive credentials in an external secrets management solution such as: +Common approaches include the following: - AWS Secrets Manager - Azure Key Vault - Google Secret Manager - HashiCorp Vault +* AWS EKS - Use AWS KMS for envelope encryption of Kubernetes Secrets. +* Azure AKS - Enable Secret encryption using Azure Key Vault and a customer-managed key (CMK) or the AKS Secret encryption feature. +* Google GKE - Configure Application-layer Secrets Encryption using Cloud KMS. +* Self-managed Kubernetes clusters - Configure an `EncryptionConfiguration` file for the API server and use a supported provider such as AES-CBC, Secretbox, or an external KMS provider. -These solutions can be integrated with Kubernetes using the External Secrets Operator or the Secrets Store CSI Driver, reducing the need to store long-lived credentials directly in Kubernetes Secrets. -For environments that require strict security or compliance controls, Mendix recommends enabling Secret encryption at rest and following your organization's key management policies. +In addition, consider storing highly sensitive credentials in an external secrets management solution such as the followings: +* AWS Secrets Manager +* Azure Key Vault +* Google Secret Manager +* HashiCorp Vault + +These solutions can be integrated with Kubernetes using the External Secrets Operator or the Secrets Store CSI Driver, reducing the need to store long-lived credentials directly in Kubernetes Secrets. For environments that require strict security or compliance controls, Mendix recommends enabling secret encryption at rest and following your organization's key management policies. #### Using a ConfigMap