Prefer using secrets as files over secrets as environment variables

How it is checked

Audit method: Shell command

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Update workloads to avoid passing secrets through environment variables. Prefer direct Secret Manager API access through Workload Identity Federation for GKE and Google Cloud client libraries. This keeps sensitive data outside cluster storage, avoids long lived service account keys, and uses IAM rather than in cluster RBAC for Secret Manager access. • Modify application code to read secrets from Secret Manager API where possible. • Use a dedicated Kubernetes ServiceAccount for each workload identity that needs Secret Manager access. • Grant only the required Secret Manager IAM permissions to that workload identity. • When code cannot call the API directly, use the Secret Manager add-on to mount secrets as files in the Pod file system. • Remove secretKeyRef and secretRef environment variable usage from workload manifests after the new access pattern is validated.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke --level 2