Prefer exposing secrets as mounted files rather than environment variables

Cómo se verifica

Método de auditoría: Comando de shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Move workloads away from secret-backed environment variables and toward file-based secret delivery through mounted volumes, preferably using the Azure Key Vault provider for Secrets Store CSI Driver. In AKS, mounted secrets support sync and autorotation, while secrets exposed through environment variables do not update in running pods until those pods are restarted. 1. Identify workloads that use secretKeyRef or envFrom.secretRef and classify them for migration. 2. Replace environment-variable injection with mounted secret files, ideally through SecretProviderClass and the Secrets Store CSI Driver. 3. Enable secret autorotation where supported so mounted content and synced Kubernetes Secrets are refreshed automatically. 4. Update the application to read secrets from the mounted path and reload them from file when values change.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aks --level 2