LOAK Documentation

Secure your Kubernetes secrets with zero code changes

Zero Code Changes

Applications use random `kl::` placeholder values; the real value is patched into the encrypted TLS traffic in-kernel. No SDK, no sidecar, no code modifications required.

eBPF Powered

In-kernel uprobes intercept TLS writes and replace placeholders with real secret values before transmission, with minimal overhead.

Host Filtering

Restrict which destination hosts each secret can be sent to, preventing accidental or malicious exfiltration of sensitive data.