Prefer exposing secrets as mounted files rather than environment variables

SedangLevel 2Otomatisaks

Deskripsi

Prefer exposing secrets to AKS workloads as mounted files rather than as environment variables, particularly when secrets are sourced from Azure Key Vault through the Secrets Store CSI Driver. In current AKS guidance, the Key Vault integration model is volume-based, with secrets made available at a mounted path inside the container, and Microsoft documents that mounted content can be synchronized and rotated through the CSI provider. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports containers using env valueFrom.secretKeyRef or envFrom.secretRef.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Move workloads away from secret-backed environment variables and toward file-based secret delivery through mounted volumes, preferably using the Azure Key Vault provider for Secrets Store CSI Driver. In AKS, mounted secrets support sync and autorotation, while secrets exposed through environment variables do not update in running pods until those pods are restarted. 1. Identify workloads that use secretKeyRef or envFrom.secretRef and classify them for migration. 2. Replace environment-variable injection with mounted secret files, ideally through SecretProviderClass and the Secrets Store CSI Driver. 3. Enable secret autorotation where supported so mounted content and synced Kubernetes Secrets are refreshed automatically. 4. Update the application to read secrets from the mounted path and reload them from file when values change.

Properti

Sistem operasi: Apa saja
Tag: akspoliciessecrets
Referensi: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.5.1 Prefer exposing secrets as mounted files rather than environment variables

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target aks --level 2