<p>I am trying to find out how can I isolate my Kubernetes Secrets to specific Service.</p>

<p>For example, let say I have two secrets with name <code>private-key</code> and <code>public-key</code> and two Kubernetes Services <strong>auth-service</strong> and <strong>gateway-service</strong>. </p>

<p>I want to provide <code>private-key</code> secret to <strong>auth-service</strong> to generate token and provide <code>public-key</code> to <strong>gateway-service</strong> to validate generated token. All Secrets and Services are in same namespace.</p>

<p>How can I restrict access of <code>private-key</code> to only <strong>auth-service</strong>?</p>

<p>There is no way to achieve that, this is by design in Kubernetes. Secrets in Kubernetes are per namespaces, and any pod in this namespace can mount them. So the only way to achieve that is by using separate namespaces. BTW not only Secrets but also RBAC permissions are per namespace - you cannot limit user permissions to specific object but to the entire namespace.</p>

<p>Also, from a security point of view, you might want to consider a more secure solution for the private key used to sign tokens, like <a href="https://en.wikipedia.org/wiki/Hardware_security_module" rel="nofollow noreferrer">HSM</a>. There are a few cloud options, like Azure KeyVault or AWS CloudHSM that provide this feature.</p>

<p>On a final comment, this is one of the reasons we ended up building our own secrets encryption solution - <a href="https://github.com/Soluto/kamus" rel="nofollow noreferrer">Kamus</a>. Kamus let you encrypt secrets for a specific service, and only this service can decrypt them. This allows us to have a better granularity of secrets permissions, which Kubernetes secrets mechanism did not provide.</p>
