Kleidi

About Kleidi

The Evolution of Secret Management: From Trousseau to Kleidi While significant efforts are underway to harden Kubernetes component layers, native Secret Management is often overlooked. By default, Kubernetes stores secrets in etcd, encoded in Base64. Even when the underlying filesystem is encrypted, the secrets themselves remain vulnerable within the key-value store.

To address this, many organizations turn to external tools that bypass native Kubernetes workflows. However, forcing teams to adopt non-native tools creates operational silos, increasing the cost and complexity of "Day 2" operations by requiring niche skill sets and fragmented tooling.

Kleidi (the successor to Trousseau) bridges this gap by providing a seamless, secure, and native experience. While Trousseau pioneered the use of the KMSv1 framework, Kleidi elevates the standard by supporting the Kubernetes KMSv2 plugin framework.

By integrating directly with Key Management Service (KMS) providers and Hardware Security Modules (HSM), Kleidi ensures that encryption keys never leave their secure environment. With Kleidi, users and workloads leverage the standard Kubernetes Secret API, gaining enterprise-grade security without sacrificing the native developer experience.

Keywords

• Container
• Kms
• Kubernetes
• Secret
• Secret Management
• Security
• Zerotrust

Address

• Headquarters

  EindhovenNoord-Brabant, Netherlands