Agentless Kubernetes Security

Secure Your Secrets, Agentless

Kloak transparently intercepts HTTPS traffic in Kubernetes using pure eBPF, replacing random placeholders with real secrets at the network edge. Your applications never see the actual credentials, so a compromised process cannot leak what it never had.

Learn More
eBPF Powered
Zero Code Changes
K8s Native
app 
# Your app sends this header:
Authorization: kl::5Gyh7ae*XwH2f2WZoZ351e3sk

# Kloak transforms it to:
Authorization: Bearer sk-live-xyz123...

✓ Secret never exposed to application
quick start 
# Install Kloak with Helm
$ helm repo add kloak https://chart.getkloak.io
$ helm repo update
$ helm install kloak kloak/kloak \
    -n kloak-system --create-namespace \
    --set demo.enabled=true
Features

Everything You Need for Secure Secret Management

Kloak provides enterprise-grade security without the complexity

Secure by Design

Secrets are replaced at the network edge. Your application code never sees real credentials, eliminating accidental exposure.

Zero Latency Impact

eBPF-powered traffic redirection happens in kernel space, adding negligible overhead to your requests.

Kubernetes Native

Works with standard Kubernetes Secrets. Add a label and Kloak handles the rest automatically.

Host Restrictions

Control which secrets can be used with which hosts. Prevent credential misuse with fine-grained access control.

Zero Code Changes

No SDK required. Works with Go, Bun, and runtimes built on OpenSSL 3.x or BoringSSL (Python, Node.js, curl, and more). Your manifests stay the same.

Pure eBPF Integration

No bulky sidecars or complex CNI plugins. Kloak operates purely at the kernel level for maximum efficiency.

Open Source

Fully open source under the AGPL-3.0 License. Inspect the code, contribute, and build with confidence.

How It Works

Simple, Secure, Transparent

Kloak operates at the network layer, making secret management invisible to your applications

01

Register Your Secrets

Label your Kubernetes secrets with getkloak.io/enabled=true. Kloak generates a random kl:: placeholder of the same length for each secret value. 

labels:
  getkloak.io/enabled: "true"
annotations:
  getkloak.io/hosts: "api.example.com"
02

Mount Secrets As Usual

Mount the Secret as you normally would. Kloak's webhook swaps in the placeholder copy, so your app never sees the real value. 

headers:
  Authorization: "kl::5Gyh7ae*XwH2f2WZoZ351e3sk"
03

Automatic Transform

When your app makes an HTTPS request, Kloak patches the real secret into the encrypted request in-kernel as it leaves the pod. 

# Request leaves your pod with real credentials
Authorization: Bearer sk-live-xyz123...
Architecture

Built for Kubernetes

A cloud-native solution using proven technologies

Control Plane
Controller
Watches secrets & manages eBPF programs
Data Plane
Application Pod
App
eBPF Traffic Control & Secret Replacement