Mount secrets as files instead of environment variables

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review workload manifests and identify any Pod, Deployment, DaemonSet, StatefulSet, Job, or CronJob that exposes secrets through environment variables instead of mounted files. Check for both direct secret references through env[].valueFrom.secretKeyRef and bulk secret imports through envFrom[].secretRef, because either pattern exposes secret data as environment variables. Prefer workloads that consume secrets through mounted Secret volumes or file delivery from AWS secrets integrations instead.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Update workloads to consume secrets as mounted files instead of environment variables. Replace env[].valueFrom.secretKeyRef and envFrom[].secretRef usage with Kubernetes Secret volumes or the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, and then update the application to read the secret from the mounted file path. This reduces the chance of secret values appearing in logs and aligns with the recommended file delivery pattern for EKS workloads. For Kubernetes Secrets, mount the Secret as a volume and update the application configuration to read from the mounted path rather than from environment variables.