Fun with Yubikeys: Hardware-Backed Kubernetes Auth

The private key that grants admin access to your Kubernetes cluster shouldn&rsquo;t live in ~/.kube/config . It shouldn&rsquo;t live on your filesystem at all. I built a proxy that keeps my k8s client credentials locked inside a YubiKey . TL;DR: If you just want the tool: yubikey-kube-proxy . Read on for how it works. The Problem: Secrets on Disk I&rsquo;m running a single-node k3s cluster on a…