Show HN: Kloak, A secret manager that keeps K8s workload away from secrets

Kloak transparently intercepts HTTPS traffic in Kubernetes using pure eBPF, replacing hashed placeholders with real secrets at the network edge. Your applications never see the actual credentials, so a compromised process cannot leak what it never had.

# Your app sends this header:
Authorization: kloak:MPZVR3GHWT4E6YBCA01JQXK5N8
# Kloak transforms it to:
Authorization: Bearer sk-live-xyz123...
✓ Secret never exposed to application

# Install Kloak with Helm
$ helm repo add kloak https://chart.getkloak.io
$ helm repo update
$ helm install kloak kloak/kloak \
-n kloak-system --create-namespace \
--set demo.enabled=true

Kloak provides enterprise-grade security without the complexity

Secrets are replaced at the network edge. Your application code never sees real credentials, eliminating accidental exposure.

eBPF-powered traffic redirection happens in kernel space, adding negligible overhead to your requests.

Works with standard Kubernetes Secrets. Add a label and Kloak handles the rest automatically.

Control which secrets can be used with which hosts. Prevent credential misuse with fine-grained access control.

No SDK required. Works with any language or framework. Use the hash placeholder in your config.

No bulky sidecars or complex CNI plugins. Kloak operates purely at the kernel level for maximum efficiency.

Fully open source under the AGPL-3.0 License. Inspect the code, contribute, and build with confidence.

Kloak operates at the network layer, making secret management invisible to your applications

Label your Kubernetes secrets with getkloak.io/enabled=true. Kloak generates a unique ULID placeholder for each secret value.

labels:
getkloak.io/enabled: "true"
getkloak.io/hosts: "api.example.com"

Reference the generated hash in your application config instead of the actual secret. Your app never sees the real value.

headers:
Authorization: "kloak:MPZVR3GHWT4E6YBCA01JQXK5N8"

When your app makes an HTTPS request, Kloak intercepts it and replaces the hash with the real secret before forwarding.

# Request leaves your pod with real credentials
Authorization: Bearer sk-live-xyz123...

A cloud-native solution using proven technologies