Effective cryptography inventory in Kubernetes requires policy enforcement, CI/CD integration, and runtime monitoring to track and enforce cryptographic standards across clusters.

Workflow for Cryptography Inventory

1. Define cryptographic policies:

   • Mandate TLS versions (1.2+), cipher suites (e.g., AES-GCM, ChaCha20), and key lengths (e.g., RSA 2048+).
   • Ban deprecated algorithms (e.g., MD5, SHA1, RC4).

2. Scan container images:

   • Use tools like Trivy or Grype to detect vulnerable dependencies and cryptographic libraries.
   • Enforce image provenance with Cosign to ensure only signed, compliant images are deployed.

3. Monitor runtime configurations:

   • Audit TLS termination points (Ingress controllers, service meshes) for cipher mismatches.
   • Use OpenShift Compliance Operator or Falco to detect anomalous cryptographic operations.

4. Centralize findings:

   • Aggregate results in a SIEM (e.g., Elastic, Splunk) or custom dashboard for visibility.

Policy Example

# Example OPA/Gatekeeper policy to enforce TLS 1.2+ in Ingress  
apiVersion: constraints.gatekeeper.sh/v1beta1  
kind: K8sRequiredProhibitedIngressTLS  
metadata:  
  name: tls12-min  
spec:  
  match:  
    kinds:  
      - apiGroups: ["networking.k8s.io"]  
        kinds: ["Ingress"]  
  parameters:  
    minTLSVersion: "1.2"  

Tooling

• Image scanning: Trivy, Clair, Snyk (for build-time cryptographic library checks).
• Provenance: Cosign (verify image signatures and SBOMs).
• Runtime: OpenShift Compliance Operator, Falco (detect anomalous crypto usage).
• Custom scripts: Parse TLS configs from Istiod or Nginx logs for cipher/algorithm tracking.

Caveat: No turnkey tool maps cryptographic posture to compliance frameworks (e.g., PQC readiness). Manual correlation or custom tooling is required.

Tradeoffs

• False positives: Overly strict policies may block legitimate traffic (e.g., legacy clients requiring TLS 1.0).
• Performance: Enforcing mTLS at scale increases latency; balance security with resource constraints.
• Coverage gaps: Runtime tools may miss application-layer crypto (e.g., custom encryption in code).

Troubleshooting

• Image rejection:

  • Check Cosign verification logs: cosign verify --key cosign.pub <image>
  • Ensure SBOMs are generated and validated during CI.

• Cipher mismatches:

  • Test TLS configurations: openssl s_client -connect <host>:<port> -tls1_2
  • Review Ingress/Service mesh configs for allowed ciphers.

• Expired certificates:

  • Monitor cert lifetimes with cfssl cert -check -cert cert.pem or cert-manager status.

Final Note

Inventorying cryptography is a hybrid effort: policy sets the guardrails, tooling enforces and monitors, and humans fill the gaps. Prioritize foundational controls (TLS, image signing) before chasing edge cases like PQC migration. Start small, automate incrementally, and validate with real-world traffic patterns.

Source thread: How are you inventorying cryptography across Kubernetes/OpenShift clusters?