Kloak

Kloak is an open-source Kubernetes security tool that intercepts outbound TLS traffic using eBPF uprobes, replacing hashed placeholders with real secrets at the kernel level before encryption. Applications never handle actual credentials, and no sidecars, code changes, or SDK integrations are required. It works with standard Kubernetes Secrets and can be enabled with a single label, making it a zero-friction secret injection solution for cloud-native environments.

• No code changes required — Mount a secret, make HTTPS requests, and Kloak handles the rest. No SDK, library, or application modifications needed.
• Secret isolation — Applications only see hashed shadow values (kloak:<UUID>). Real secrets exist solely in eBPF maps and are injected in-kernel at TLS write time.
• Zero overhead — eBPF uprobes operate in kernel space with negligible latency impact. No userspace proxy or sidecar sits in the data path.
• Kubernetes native — Works with standard Kubernetes Secrets. Enable Kloak for any workload with a single getkloak.io/enabled=true label.
• Host and IP filtering — Secrets annotated with getkloak.io/hosts are only sent to specific destination hostnames or IPs, preventing exfiltration to unauthorized servers.
• Port-based filtering — Secrets annotated with getkloak.io/port are restricted to connections on a specific destination port.
• Broad runtime support — Hooks into OpenSSL, BoringSSL, and Go's native crypto/tls. Works with Python, Node.js, Go, Rust, Ruby, PHP, curl, and any OpenSSL-linked runtime.
• DNS-verified trust chain — Secrets with host annotations are only rewritten when the destination is verified through the full DNS resolution chain, preventing exfiltration even if an application is compromised.
• Helm installation — Install with helm repo add kloak https://chart.getkloak.io and helm install kloak kloak/kloak -n kloak-system --create-namespace.
• Control plane + eBPF data plane — Consists of a controller (DaemonSet), a mutating admission webhook (Deployment), and an eBPF data plane running entirely in kernel space.