Bitnami Sealed Secrets Team Collaborates with Students from the Aix-Marseille University

Authored by Alfredo García, R&D Manager at VMware

Bitnami’s Sealed Secrets has been a popular GitOps Secret Management solution ever since its launch back in 2017. With 5.4K starts and more than a million downloads per month, this project has a lot of traction and is widely adopted amongst the open-source community.

The Bitnami by VMware team encourages and fosters collaboration with university institutions. Examples of such collaborations can be found in the more than 20 training sessions delivered by our experts during this year's VMware Multi-cloud Academy.

While we regularly collaborate with institutions, opportunities to collaborate directly with computer science students are few and far between. For this reason, when Aix-Marseille University approached us with an offer to collaborate with some of their Reliability and IT Security Master’s Degree students, we quickly jumped on the idea. This proposal was translated into a two-month collaboration period in which several important features have been implemented in the Sealed Secrets project. 

Collaboration Scope

The collaboration started early in 2022 with some meetings with the faculty responsible for the Master’s Degree in Reliability and IT Security of the Aix-Marseille University, in order to define the scope and the approach of our cooperation. We agreed that five students will incorporate their work on the Sealed Secrets project as a part of their final dissertation for the Master’s degree they were undertaking. 

Those students had neither a previous background in collaborating with open source projects nor any proven experience in developing with Golang. To help them to be more efficient, the Bitnami by VMware Sealed Secrets team provided a minimum onboarding plan. This plan included the set-up of a GitHub account, a brief introduction to the project contributing guidelines, and a list of recommended readings that could help them better understand Sealed Secrets design and purpose.

The collaboration lasted from March to April 2022, and during that time, the students took ownership of several tasks in our project backlog focusing mainly on solving security and software supply chain issues. All these tasks were closely related to the content of their Master’s degree curriculum, so they dealt with them efficiently. 

These activities were grouped into three major blocks:

• Secure software supply chain
• Static code analysis and vulnerability scanning
• Sealed Secrets cryptographic review 

Secure Software Supply Chain

Needless to say, the software supply chain is a big concern for any organization. Given the importance of the Sealed Secrets project within the Kubernetes Security area, it is essential to control our dependencies and to provide a solid provenance for our deliverables.

Because of that, we asked the students to incorporate cosign verifications over the Sealed Secrets distroless and base images. They also included a cosign signature for the Controller images, Kubeseal CLI, and for the project’s official Helm chart. These improvements will make it easier for our users to verify the provenance of Sealed Secrets once included in their clusters.

Static Code Analysis and Vulnerability Scanning

Static code analysis is a great way to detect inefficiencies or security concerns on a codebase. Additionally, vulnerability scanning is a critical step in any continuous integration (CI) pipeline. In our case, we decided to include two complementary tools within the project CI process: gosec and trivy. For this last integration, in particular, Sealed Secrets leverages VMware Image Builder verification capabilities so that vulnerabilities are detected as part of the project release process. 

This task was related not only to integrating the tools but to analyzing the different reports and deciding which among various incidents were false positives and which could be added to the project as recommended code practices. The students included ten different Pull Requests (PRs) and some important improvements in Sealed Secrets security stance.

Sealed Secrets Cryptographic Review

The Sealed Secrets project had a few documents about cryptography, with little internal cohesion between them. It was difficult for new developers to understand the security stance of the project with these guides, so we decided to review and consolidate our Cryptography-related documentation.

A hot topic in cybersecurity is how to protect encrypted information against brute-force attacks executed with the help of quantum computers. These kinds of attacks are not yet possible with the current quantum processing power, but many security providers are designing algorithms that will be quantum resistant. To anticipate future developments, the students included in the Cryptographic documentation some recommendations and good practices regarding Post-quantum cryptography.  

Conclusion

The collaboration between the Aix-Marseille Cybersecurity Master students and the Sealed Secrets team has resulted in the merging of 18 Pull Requests into the project. These PRs include several important features that have improved the security posture of Sealed Secrets. Furthermore, the students have demonstrated great skills and determination by identifying key improvements and implementing them in the project. We recommend checking out their GitHub profiles and following them to discover this and other contributions to the open-source community. 

• Adrien MOLLET - @volker-carstein
• Luc BOBO - @luhko
• M'hamed BELHACHEMI M'HAMED - @Belhach
• Nicolas THOMAS - @JeNeComprendPas
• Nicolas BOURRAS - @vivescere

 We’d like to acknowledge their efforts and contributions and wish them the best in their next ventures!

Deploy Applications with Confidence and Control with VMware Application Catalog™ and Sealed Secrets

Raquel Campuzano and Juan Ariza co-wrote this blog post

As more organizations adopt Kubernetes as the preferred infrastructure for running their IT resources, enterprise SRE teams tend to adopt a GitOps mindset.  

The GitOps approach consists of embracing different practices that manage infrastructure configuration as a code. This means that Git becomes the single source of truth and as such, all operations are tracked via commits and pull requests. Thus, every action performed on the infrastructure will leave a trace and can be reverted if needed.  

This practice brings a lot of benefits to IT admins, since automation and ease of managing Kubernetes configurations are extremely important to them. 

Despite this, there’s a high probability of discovering security risks when managing access to the applications running in a Kubernetes cluster. This is where Sealed Secrets comes in. Sealed Secrets is a  Kubernetes controller and a tool for one-way encrypted Secrets.  

Why should every cluster controller use Sealed Secrets to protect their deployments?  

When cluster operators and administrators follow the GitOps approach, they usually find that they can manage all Kubernetes configurations through Git except secrets. Sealed Secrets solves this problem by encrypting the secret into a new Kubernetes object called “SealedSecret” which is safe to store even in public repositories.  

Sealed Secrets is a popular Open-Source project led by Bitnami that helps Kubernetes operators and administrators keep their deployments safe and under control. Sealed Secrets can only be decrypted by those who have access to the sealing private key — usually the cluster administrator — ensuring that nobody else, even the original author, is able to obtain the secret given in a Sealed Secret manifest file. 

Sealed Secrets is now available as a Helm chart in VMware Application Catalog! VMware Application Catalog is a customizable selection of trusted, pre-packaged open-source application components that are continuously maintained and verifiably tested for use in enterprise production environments – the ideal option to procure secure application building blocks.  

Depending on your requirements, you can either navigate to the ongoing Open-Source project located in the Bitnami GitHub repository and download the tool and test it out, or if your organization requires a more stable, secure, and compliant image, you can deploy Sealed Secrets on your cluster through VMware Application Catalog.  

Deploy Sealed Secrets on Kubernetes through VMware Application Catalog

The following steps describe how to navigate to VMware Application Catalog — formerly known as Tanzu Application Catalog — and deploy Sealed Secrets in your cluster. 

Once you have it installed, you will be able to deploy any application — this blog post uses MariaDB as an example, but you can pick another solution existing in your catalog — and encrypt its secrets using a Sealed Secret.   

This post assumes that you already have: 

• Sealed Secrets and MariaDB added to your VMware Application Catalog 
• Kubeseal was previously installed on your computer. 

Navigate to app-catalog.vmware.com and sign in with your VMware account to your catalog. 

In the “My Applications” section, search for Sealed Secrets Helm chart and click “Details”. 

On the next screen, you will find the instructions for deploying the chart on your cluster. Make sure that your cluster is up and running by executing kubectl cluster-info. Then, run the commands you will find under the “Consume your Helm Chart” section.  

Once you have installed the Sealed Secrets chart, it is time to use it to encrypt the required secrets to manage the MariaDB credentials. Fortunately, the MariaDB Helm chart supports retrieving the credentials from an existing secret. 

To use that feature, you must make sure that you know which is the expected format for the MariaDB secret. You can obtain that information by checking in the MariaDB chart’s README file the “common parameters” section as shown below: 

Based on this information, you can use kubeseal to create a Sealed Secret with encrypted credentials for MariaDB by executing the command below: 

kubectl create secret generic mariadb-secret --dry-run=client \ 

  --from-literal=mariadb-root-password=ROOT_PASSWORD \ 

  --from-literal=mariadb-replication-password=REPLICATION_PASSWORD \ 

  --from-literal=mariadb-password=SOME_PASSWORD \ 

  -o yaml | kubeseal --controller-name=CONTROLLER_NAME \ 

  --controller-name=CONTROLLER_NAMESPACE \ 

  --format yaml > mariadb-sealedsecret.yaml 

Note: Remember to replace the ROOT_PASSWORD, REPLICATION_PASSWORD, and SOME_PASSWORD placeholders with the passwords you want to use to configure MariaDB. Also, replace the CONTROLLER_NAME and CONTROLLER_NAMESPACE with the name and namespace of your Sealed Secrets controller, respectively. This information is displayed in the NOTES when installing the Sealed Secret chart. 

The command above creates a new yaml file named mariadb-sealedsecret.yaml which contains the encrypted MariaDB credentials. That file should look like it is shown below: 

At this point, you can safely add this file to your Git repository. Once you have a Sealed Secret manifest, you can deploy it in your Kubernetes cluster running the command below: 

kubectl create -f mariadb-sealedsecret.yaml 

Use the following command to double-check that the Sealed Secret — and the associated secret — was successfully created: 

kubectl get sealedsecret mariadb-secret 

kubectl get secret mariadb-secret  

Now, you can deploy the MariaDB Helm chart retrieving the credentials from the existing “mariadb-secret” secret.  

To do so, back to the VMware Application Catalog and search for the MariaDB details page. Then, execute the command you will find in the “Consume your Helm Chart” by appending the following flag: 

--set auth.existingSecret=mariadb-secret 

Once the chart is installed, you can start to operate your MariaDB database as described in its installation notes. 

The last step is to obtain the chart installation values and save them in a file using the command below: 

helm get values MARIADB_RELEASE > mariadb-values.yaml 

Note: Remember to replace the MARIADB_RELEASE placeholder with the name you used for your MariaDB release. 

You can now add this mariadb-values.yaml to your Git repository.  

By committing both this and the mariadb-sealedsecret.yaml file in your repository you can record the status of your infrastructure in a reproducible manner – allowing you to again embrace the GitOps mindset.  Thanks to Sealed Secrets, now you can also publish your changes in any public repository without exposing your database credentials. 

Deploy Applications with Confidence and Control 

As shown in this blog post, the combination of Sealed Secrets and VMware Application Catalog allows you to deploy applications in your cluster with complete confidence. Apart from keeping your applications automatically updated and monitored thanks to VMware Application Catalog, now you can rely on the efficiency of Sealed Secrets for keeping your deployments locked and safe against misuse.  

Learn more about VMware Application Catalog by checking its product page on vmware.com. You can also check out technical documentation for VMware Application catalog here. You can also contact the VMware Application Catalog team directly at vac@vmware.com.

If you are interested in contributing to the Sealed Secrets Open Source project, check out the GitHub repository and do not hesitate to send us a pull request. The BItnami engineering team will check it and guide you in the process for a successful merge.     

Introducing Kubeapps

Today we are proud and excited to announce Kubeapps, a package agnostic application dashboard for Kubernetes. We see it as a compass that helps Kubernetes users find their way in the different ways to package a Kubernetes applications as well as a boostrapping mechanism so that all the necessary add-ons can be installed in your cluster easily.

For those of you who have been long-time Helm users, the website kubeapps.com may be familiar- until now it was a Chart discovery site. We decided to build upon the success of Kubeapps and extend the experience to bring applications of all types to Kubernetes users.

Indeed, now that it is clear that Kubernetes has won the container orchestration battle, it is time to focus on applications. At Bitnami we have been packaging applications for the cloud for almost a decade now. In building Kubeapps, we keep focusing on our core strength while bringing a useful service to the community and helping our customers that are embracing Kubernetes and migrating to container-based applications.

That’s why we decided to re-launch Kubeapps, making it more generic and able to handle all sorts of Kubernetes applications instead of just Helm charts. In particular, with the growing interest in serverless-based applications, our Kubeless project makes a perfect companion to Kubeapps. So Kubeapps is now made of three components:

• A command line interface that helps your bootstrap all the necessary Kubernetes cluster add-ons to deploy and manage your applications.
• A community site, hub.kubeapps.com, aimed at becoming the Docker Hub of Kubernetes applications. It now has social features like starring and commenting.
• An in-cluster application dashboard, built on Monocular, that also features the Kubeless user interface to bring in serverless capabilities to kubeapps.

From a technical standpoint, The Hub is an instance of Monocular with the added social features enabled thanks to the ability to log in to Kubeapps. The code and various microservices that it is now composed of are all available on GitHub in the Kubeapps organization. We believe that everyone in the community will enjoy starring and leaving comments on their favorite charts. In the near future, we plan to allow users to submit new applications and new application registries to Kubeapps so it can act as a true aggregator of shareable Kubernetes applications.

The command line interface is Golang binary that allows users to easily install the following add-ons into any cluster (caveat: only Minikube and GKE are tested right now, AKS is coming soon):

• Helm/tiller (in a secure, opinionated deployment configuration)
• Kubeless (our Kubernetes-native serverless solution)
• Sealed Secrets (a tool to give #gitops the ability to manage secrets securely)

As new packages and operational workflows to manage Kubernetes applications emerge we envision adding the appropriate add-ons to Kubeapps so that anyone can configure their cluster to meet their specific needs. Sealed Secrets might seem a little odd in this mix, but we believe that a significant number of users will start moving to a declarative mindset and will adopt a #gitops workflow like what is described by our friends from [Weave works](https://engineering.bitnami.com/articles/secure-gitops.html ).

Each add-on is defined in a jsonnet manifest available on GitHub. These manifests are turned into full YAML manifests and embedded in the code of `kubeapps`. This gives the ability to deploy the add-ons in a declarative manner, set labels, and configure garbage collection properly. A lot of the code that is in `kubeapps` was first introduced in our work on `kubecfg` as part of the ksonnet project. Once you download the binary you have two key commands to learn:

• `kubeapps up` (will create all the required resources to make the add-ons work)
• `kubeapps down` (if you wish to remove everything)

Here is a snapshot of the output of `kubeapps up`:



The third command in the Kubeapps CLI is:

`kubeapps dashboard`




This will connect you to a dashboard running in your cluster. This dashboard is based on Monocular as well but has the added functionality to deploy Helm Charts directly from the web interface. It also now integrates the Kubeless UI, making the Kubeapps dashboard a one stop shop for both Helm Charts and Serverless functions. Below is a snapshot of the Kubeless UI.




This is just the beginning for Kubeapps. As our friends from CoreOS mention in their 2018 predictions, 2 out of 5 critical areas are going to be Kubernetes applications and Serverless. With Kubeapps we are very excited at Bitnami to be addressing these needs already, offering a package agnostic launchpad for Kubernetes applications. One that brings serverless functions and any type of app formats together under one roof.

Look for an improved UI, more social features to build a great application hub for Kubernetes plus the ability to support declarative management of applications. This is going to be an exciting 2018 and Kubeapps is just the beginning.