Kubernetes Secrets Auto Delete

Question

I am wondering about Kubernetes's secret management. I have a process that generates a lot of secrets that only need to live for a short while.

I would like for these secrets to come from Vault or a similar service in the future. However, for right now, I don't have the time to implement this.

If someone could provide me with the documentation or delineate the secret life cycle, it would be super helpful. Does Kubernetes have the means to garbage collect these secrets as it does with containers?

Likewise, I am wondering if there is a way to set cascading deletes when this one resource disappears, so does its secrets?

A quick search returned me this - https://medium.com/ww-engineering/working-with-vault-secrets-that-expire-aa40d00d9d2a — Praveen Sripati, Apr 07 '20 at 14:57
Unfortunately, I can't get vault working before the deadline — Aaron, Apr 07 '20 at 15:43

score 2 · Answer 1 · answered Apr 07 '20 at 15:25

2

Kubernetes has no notion of secret lifetime.

you can implement a CronJob in charge of checking then deleting secret in specific namespace(s) if the secret is older that a specific time.
you can create all your secrets in a temporary namespace, destroying the namespace will destroy all the secrets associated with this namespace.
use Vault

answered Apr 07 '20 at 15:25

Kartoch

7,610
9
40
68

The cronjob sounds promising. I really do want to use Vault. However, I have a time constraint that makes it infeasible. – Aaron Apr 07 '20 at 15:45

score 0 · Answer 2 · answered Feb 10 '23 at 12:05

0

You can use the kube-janitor operator that allows you to add expiration dates or ttl as a label in your secret definition (or any kube resource)

answered Feb 10 '23 at 12:05

jujule

11,125
3
42
63

Kubernetes Secrets Auto Delete

2 Answers2