From e1454289106f031d30059663e4f66706c463efea Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Sat, 14 Nov 2020 14:39:43 +0100 Subject: [PATCH] Add notes about backups --- slides/k8s/sealed-secrets.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/slides/k8s/sealed-secrets.md b/slides/k8s/sealed-secrets.md index 33d92276..34ae7f18 100644 --- a/slides/k8s/sealed-secrets.md +++ b/slides/k8s/sealed-secrets.md @@ -256,7 +256,7 @@ If you change that, you will also need to inform `kubeseal` later on. --- -## Discussion +## Discussion (the good) - The footprint of the operator is rather small: @@ -266,6 +266,10 @@ If you change that, you will also need to inform `kubeseal` later on. - a few RBAC-related objects +--- + +## Discussion (the less good) + - Events could be improved - `no key to decrypt secret` when there is a name/namespace mismatch @@ -274,6 +278,14 @@ If you change that, you will also need to inform `kubeseal` later on. - Key rotation could be improved (how to find secrets corresponding to a key?) +- If the sealing keys are lost, it's impossible to unseal the SealedSecrets + + (e.g. cluster reinstall) + +- ... Which means that we need to back up the sealing keys + +- ... Which means that we need to be super careful with these backups! + --- ## Other approaches