Kamus open source intro

1. Kamus Introduction
Omer Levi Hevroni (@omerlh)
Janury 14th

2. @omerlh
Third iteration – Kamus

3. @omerlh
What?
• Secrets encryption/decryption solution
• Native Kubernetes integration
• Seamless consuming
• Side-car to generate config files
https://github.com/Soluto/kamus

4. @omerlh
Kamus?

5. @omerlh
Architecture
https://github.com/octo-technology/kubernetes-icons - Apache 2
Encryptor Decryptor

6. @omerlh
Kubernetes Service Account
A service account provides an identity for a Pod.
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

7. @omerlh
Permission Model
Encrypt Decrypt
User Yes (Can be
limited)
No
Pod Yes Only it’s own
secrets

8. @omerlh
Consuming Secrets
Init Container
Application
Memory
Medium

9. http://i.imgur.com/qpUHa.jpg
Demo Time!
https://github.com/Soluto/kamus/tree/master/example

10. https://memegenerator.net/instance/82530764/geico-pinocchio-we-take-security-seriously

11. @omerlh
Kamus Secure Design
• Strong keys storage (Azure KeyVault/GCP KMS)
• HSM
• IP Filtering
• Separated pods for encrypting and decrypting
• Secured CLI
• Enforce HTTPS
• Support for certificate pinning

12. @omerlh
Public Threat Model
https://github.com/Soluto/kamus/blob/master/docs/features

13. @omerlh
Security Tests
• Static Analysis (Checkmarx)
• Dynamic Analysis (Zap)
• Packages Scan (Snyk)

14. @omerlh
Security.md
https://github.com/Soluto/kamus/blob/master/security.md

15. @omerlh
Accepted Risks
• Any pod in the same namespace can mount any service account
• Pod impersonation
• Can be solved with admission controller or OPA
• Clear text traffic inside the cluster
• Service account token never expires

16. @omerlh
How do I use it?
• Simply using helm:
helm install soluto/kamus
• Checkout the install guide for secure
installation
• <blog post!>

17. @omerlh
Project Status
• Live in production for the past 6 months
• Improved based on internal feedback
• Fast adoption by developers
• Released as OSS

18. @omerlh
Kamus Future
• AWS KMS support
• Secret CRD
• Rolling encryption keys
• Quality – improve coverage
• FASS

19. Thank You!
Omer Levi Hevroni (@omerlh)