How do you manage kubeconfig files securely on your machine? I'm especially interested in setups where someone works on backend or frontend code while also administering clusters. If supply-chain malware runs with your local user permissions, how do you reduce the risk of exposing cluster credentials and make kubectl or k9s access safer?
3 Answers
Encrypting the file alone doesn’t fully solve the problem. Malware running as your user can potentially access anything you’re able to decrypt. The more meaningful defense is making stolen files and tokens expire quickly. We use cluster login tokens that last only a few hours, with Dex or Keycloak plus kubelogin for authentication. That’s much safer than a client certificate that remains valid for a year.
We connect Kubernetes to Okta using SSO and short-lived tokens. The kubeconfig doesn’t contain a reusable credential, so there’s nothing long-lived sitting on disk to steal. Expiring tokens and requiring authentication again is the main protection.
We encrypt the kubeconfig with SOPS and use an age key stored in 1Password. Our environment setup tool handles prompting for the 1Password authentication, then exposes the decrypted configuration only when needed for tools like kubectl or k9s.
That makes sense—the goal is to limit the usefulness of anything a local compromise can grab, rather than assuming encryption will protect a credential while it’s actively being used.