Secret Scanning Infrastructure in Kubernetes (POC)

The architecture revolves around a Kubernetes cluster orchestrating containerized components that perform distributed secret scanning. I built a React-based frontend that allows authenticated users to submit repository URLs along with encrypted access tokens. These tokens are securely handled using Azure Key Vault, ensuring that credentials never appear in plaintext anywhere in the pipeline.

The submitted requests are passed to a Go-powered scan service via REST APIs. This microservice validates user access and publishes scan jobs to an Apache Kafka topic, enabling robust message queuing for distributed processing. A separate Go consumer service listens to this Kafka topic, dynamically provisions Kubernetes pods and persistent volumes, and spins up truffle-scanner containers that clone the specified repositories.

Inside each container, the Trufflehog tool scans for hard-coded secrets such as API keys, passwords, or cryptographic keys. The findings are parsed, filtered for false positives, and then stored securely in a PostgreSQL database. I also configured secure storage of logs and scan results to comply with privacy best practices.

This project helped me master multiple technologies, including Kubernetes orchestration, Kafka for resilient message handling, Terraform for infrastructure as code, Docker containerization, and vault-based secret management. Moreover, the solution was designed with DevSecOps in mind — seamlessly integrating with CI/CD workflows to prevent secrets from reaching production environments.