Show HN: Kloak, A secret manager that keeps K8s workload away from secrets

Post by NewJazz » Sat, Apr 25, 2026, 8:57 PM UTC

subhobroto wrote: post #8

neo2006 wrote: post #3

Hey, we're the spinning-factory team, the folks behind Kloak. Kloak runs as a Kubernetes controller. It swaps the secrets in your workloads for harmless placeholders we call kloaked secrets, then uses eBPF to substitute the real secrets back in at the last moment — right when your app makes a request to an allowed host. Today, Kloak works with any app using OpenSSL 3.0–3.5 (statically or dynamically linked) or go-tls…

This is fantastic! I need this. however, for my self-hosted home projects that are containerized but where I don't use Kubernetes, is there a way for me to use a version of Kloak that does the same eBPF magic on docker-compose or LXC/QEMU (Incus) stacks? It's perfectly fine for you to say non-Kubernetes isn't either your focus or on your 90 day roadmap :)

Post by anthonyskipper » Sat, Apr 25, 2026, 9:05 PM UTC

Post by spinningfactory » Sat, Apr 25, 2026, 9:10 PM UTC

anthonyskipper wrote: post #13

This is pretty awesome. Super relevant for the time because AI controlled workflows are desperate for a out of band solution like this. The main thing I wonder is how well supported is it in cloud environements? AKS/EKS/etc?

Post by anthonyskipper » Sat, Apr 25, 2026, 9:46 PM UTC

neo2006 wrote: post #6

mrweasel wrote: post #4

Yeah, so Kloak is Danish for sewer.

I guess we are the secrets sewers then! :D We would love to hear what you think about it beyond the name though.

Post by neo2006 » Sat, Apr 25, 2026, 10:06 PM UTC

NewJazz wrote: post #11

subhobroto wrote: post #8

Earlier quoted context omitted.

This is fantastic! I need this. however, for my self-hosted home projects that are containerized but where I don't use Kubernetes, is there a way for me to use a version of Kloak that does the same eBPF magic on docker-compose or LXC/QEMU (Incus) stacks? It's perfectly fine for you to say non-Kubernetes isn't either your focus or on your 90 day roadmap :)

Yeah you might have to go talk to incus folks on how to integrate this together.. They are fairly capable, might have some good direction. https://discuss.linuxcontainers.org/t/how-to-best-ask-questi...