Kloak transparently intercepts HTTPS traffic in Kubernetes, replacing hashed placeholders with real secrets at the network edge. Your applications never see the actual credentials.
# Your app sends this header:
Authorization: kloak:a1b2c3d4-e5f6-7890
# Kloak transforms it to:
Authorization: Bearer sk-live-xyz123...
✓ Secret never exposed to applicationKloak provides enterprise-grade security without the complexity
Secrets are replaced at the network edge. Your application code never sees real credentials, eliminating accidental exposure.
eBPF-powered traffic redirection happens in kernel space, adding negligible overhead to your requests.
Works with standard Kubernetes Secrets. Just add a label and Kloak handles the rest automatically.
Control which secrets can be used with which hosts. Prevent credential misuse with fine-grained access control.
No SDK required. Works with any language or framework. Just use the hash placeholder in your config.
Envoy sidecars are automatically injected via mutating webhook. Just label your namespace.
Kloak operates at the network layer, making secret management invisible to your applications
Label your Kubernetes secrets with getkloak.io/enabled=true. Kloak generates a unique hash (UUID) for each secret value.
labels:
getkloak.io/enabled: "true"
getkloak.io/hosts: "api.example.com"Reference the generated hash in your application config instead of the actual secret. Your app never sees the real value.
headers:
Authorization: "kloak:a1b2c3d4-e5f6-7890"When your app makes an HTTPS request, Kloak intercepts it and replaces the hash with the real secret before forwarding.
# Request leaves your pod with real credentials
Authorization: Bearer sk-live-xyz123...A cloud-native solution using proven technologies
Try the demo or deploy to your cluster
git clone https://github.com/spinningfactory/kloak.git && cd kloak./examples/setup-demo.shexport KUBECONFIG=/tmp/kloak-k3s.yaml
kubectl logs demo-python -n kloak-demo -c demo-appmake buildmake docker-buildkubectl apply -f config/manifests/Join the growing community of developers using Kloak to manage secrets securely.