Optimizing docker image encryption—kubernetes using shamir secrets to enforce multiple constraints in container runtime environment
One example method includes using a primary key to encrypt a decryption key, splitting the primary key into ‘n’ parts, where at least ‘k’ parts of the ‘n’ parts are required to restore the primary key, and ‘k’≤‘n’, storing some of the ‘k’ parts in respective locations in a production environment, and one of the stored ‘k’ parts is held by a verifier stage, receiving, at the verifier stage, a request for restoration of the primary key, where the request is received from a deployment pod and the request includes a subset of the ‘k’ parts and the encrypted decryption key, performing, by the verifier stage, a validation process concerning the deployment pod, and restoring, by the verifier stage, the primary key, wherein the primary key is restored using the ‘k’ part held by the verifier stage.
1. A method, comprising:
using a primary key to encrypt a decryption key;
splitting the primary key into ‘n’ parts, where at least ‘k’ parts of the ‘n’ parts are required in order to restore the primary key, and ‘k’=‘n’;
storing some of the ‘k’ parts in different respective locations in a production environment, and one of the ‘k’ parts that is stored is held by a verifier stage;
receiving, at the verifier stage, a request for restoration of the primary key, where the request is received from a deployment pod and the request includes a subset of the ‘k’ parts and the encrypted decryption key;
performing, by the verifier stage, a validation process concerning the deployment pod;
upon successful validation of the deployment pod, restoring, by the verifier stage, the primary key, wherein the primary key is restored using the ‘k’ part held by the verifier stage, and using the subset of the ‘k’ parts received from the deployment pod; and
using, by the verifier stage, the restored primary key to decrypt the encrypted decryption key received from the deployment pod.
2. The method as recited in claim 1 , further comprising transmitting, by the verifier stage, the decrypted decryption key to the deployment pod.
3. The method as recited in claim 2 , further comprising using, by the deployment pod, the decryption key received from the verifier stage to decrypt sensitive content needed to run a container that is included in the deployment pod.
4. The method as recited in claim 1 , further comprising verifying information in a deployment manifest associated with the deployment pod and, upon successful verifying, adding one of the parts of the subset of ‘k’ parts to the deployment manifest, and transmitting the deployment manifest to a deployment controller.
5. The method as recited in claim 1 , further comprising encrypting sensitive content of a container using an encryption key, and the encryption key serves as the decryption key that is encrypted using the primary key.
6. The method as recited in claim 1 , wherein the primary key is not restored by the verifier stage unless the deployment pod is validated.
7. The method as recited in claim 1 , wherein the method is performed in a production environment, and one of the parts in the subset of ‘k’ parts is provided at least indirectly to the deployment pod by an entity outside of the production environment.
8. The method as recited in claim 1 , wherein one of the parts in the subset of ‘k’ parts is provided at least indirectly to the deployment pod by a deployment verification service.
9. The method as recited in claim 1 , wherein the decryption key received by the deployment pod is not stored anywhere.
10. The method as recited in claim 1 , wherein the parts of the primary key are never all transmitted together.
11. A computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
using a primary key to encrypt a decryption key;
splitting the primary key into ‘n’ parts, where at least ‘k’ parts of the ‘n’ parts are required in order to restore the primary key, and ‘k’=‘n’;
storing some of the ‘k’ parts in different respective locations in a production environment, and one of the ‘k’ parts that is stored is held by a verifier stage;
receiving, at the verifier stage, a request for restoration of the primary key, where the request is received from a deployment pod and the request includes a subset of the ‘k’ parts and the encrypted decryption key;
performing, by the verifier stage, a validation process concerning the deployment pod;
upon successful validation of the deployment pod, restoring, by the verifier stage, the primary key, wherein the primary key is restored using the ‘k’ part held by the verifier stage, and using the subset of the ‘k’ parts received from the deployment pod; and
using, by the verifier stage, the restored primary key to decrypt the encrypted decryption key received from the deployment pod.
12. The computer readable storage medium as recited in claim 11 , wherein the operations further comprise transmitting, by the verifier stage, the decrypted decryption key to the deployment pod.
13. The computer readable storage medium as recited in claim 12 , wherein the operations further comprise using, by the deployment pod, the decryption key received from the verifier stage to decrypt sensitive content needed to run a container that is included in the deployment pod.
14. The computer readable storage medium as recited in claim 11 , wherein the operations further comprise verifying information in a deployment manifest associated with the deployment pod and, upon successful verifying, adding one of the parts of the subset of ‘k’ parts to the deployment manifest, and transmitting the deployment manifest to a deployment controller.
15. The computer readable storage medium as recited in claim 11 , wherein the operations further comprise encrypting sensitive content of a container using an encryption key, and the encryption key serves as the decryption key that is encrypted using the primary key.
16. The computer readable storage medium as recited in claim 11 , wherein the primary key is not restored by the verifier stage unless the deployment pod is validated.
17. The computer readable storage medium as recited in claim 11 , wherein the computer readable storage medium is performed in a production environment, and one of the parts in the subset of ‘k’ parts is provided at least indirectly to the deployment pod by an entity outside of the production environment.
18. The computer readable storage medium as recited in claim 11 , wherein one of the parts in the subset of ‘k’ parts is provided at least indirectly to the deployment pod by a deployment verification service.
19. The computer readable storage medium as recited in claim 11 , wherein the decryption key received by the deployment pod is not stored anywhere.
20. The computer readable storage medium as recited in claim 11 , wherein the parts of the primary key are never all transmitted together.