Prefer using secrets as files over secrets as environment variables

Méthode de vérification

Méthode d'audit: Commande shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Update workloads to avoid passing secrets through environment variables. Prefer direct Secret Manager API access through Workload Identity Federation for GKE and Google Cloud client libraries. This keeps sensitive data outside cluster storage, avoids long lived service account keys, and uses IAM rather than in cluster RBAC for Secret Manager access. • Modify application code to read secrets from Secret Manager API where possible. • Use a dedicated Kubernetes ServiceAccount for each workload identity that needs Secret Manager access. • Grant only the required Secret Manager IAM permissions to that workload identity. • When code cannot call the API directly, use the Secret Manager add-on to mount secrets as files in the Pod file system. • Remove secretKeyRef and secretRef environment variable usage from workload manifests after the new access pattern is validated.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target gke --level 2