Prefer exposing secrets as mounted files rather than environment variables

Méthode de vérification

Méthode d'audit: Commande shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Update workloads to consume secrets as mounted files instead of environment variables. Replace env[].valueFrom.secretKeyRef and envFrom[].secretRef usage with Kubernetes Secret volumes or the OCI Secrets Store CSI Driver Provider with the Secrets Store CSI Driver, then update the application to read the secret from the mounted file path. This reduces the chance of secret values appearing in logs and aligns with the OCI Vault based file delivery pattern for OKE workloads. Replace secret environment variables with mounted secret files and update the application to read from the mounted path.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target oke