container image encryption solution

[bflance]

Hi guys,

Maybe it is a bit "off topic", but still i would like to ask and hear your thought and maybe find a solution.

Lets say i have a container image on my laptop, and that image has some important and very secret data in it.
now, i need to deploy that container on my talos cluster at some datacenter,etc..

the thing is, if i push that container to remote registry, i only can hope that nobody can actually break that registry and get access to container image with secrets held within.

i was thinking about some kind of solution to basicly send encrypted container with skopeo (for example: check this blogpost)
but here the fun end.
Talos cluster (or any other k8s cluster for that matter) must have a way to pull and decrypt that image in order to use it.
and here i am a bit lost.

i was thinking about "imgcrypt" (https://github.com/containerd/imgcrypt), which uses CRI under the good to decrypt images using Certificates (located on worker node), but it seems to me that doesnt doesnt support that out-of-the-box..

any ideas, comments, suggestions are mostly welcome indeed.

🙏

[smira]

Decouple container image and secrets, use Kubernetes Secrets to attach secrets to the container.

[bflance]

sorry, maybe i didnt properly conveyed the idea, or didnt understand your answer :)
my docker images have some important files (proprietary info), i need to protect them.
basicly, the requirement is following:

1. image is baked in my laptop
2. image encrypted on laptop and leaves it using skopeo in encrypted form to registry
3. on that registry it lives its encrypted and protected life..
4. when k8s cluster pulls image from registry, it can (and only it) to decrypt this image and run it.
5. when pod is dead , no traces of that image is left on the k8s worker node.

[smira]

I don't know about any such solution immediately available, and as k8s is a multi-tenant environment, so doesn't sound like a great plan.

My suggestion is to stop storing secrets in the container image, and instead use Kubernetes Secrets and mount them to the container to provide secret data.

Nobody stores database passwords in the container image, but rather uses Kubernetes Secrets and mounts them into the pod.