Prefer using secrets as files over secrets as environment variables

Cara pemeriksaan

Metode audit: Perintah shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Update workloads to avoid passing secrets through environment variables. Prefer direct Secret Manager API access through Workload Identity Federation for GKE and Google Cloud client libraries. This keeps sensitive data outside cluster storage, avoids long lived service account keys, and uses IAM rather than in cluster RBAC for Secret Manager access. • Modify application code to read secrets from Secret Manager API where possible. • Use a dedicated Kubernetes ServiceAccount for each workload identity that needs Secret Manager access. • Grant only the required Secret Manager IAM permissions to that workload identity. • When code cannot call the API directly, use the Secret Manager add-on to mount secrets as files in the Pod file system. • Remove secretKeyRef and secretRef environment variable usage from workload manifests after the new access pattern is validated.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target gke --level 2