Prefer exposing secrets as mounted files rather than environment variables

中レベル 2自動aks

説明

Prefer exposing secrets to AKS workloads as mounted files rather than as environment variables, particularly when secrets are sourced from Azure Key Vault through the Secrets Store CSI Driver. In current AKS guidance, the Key Vault integration model is volume-based, with secrets made available at a mounted path inside the container, and Microsoft documents that mounted content can be synchronized and rotated through the CSI provider. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports containers using env valueFrom.secretKeyRef or envFrom.secretRef.

チェック方法

監査方法: シェルコマンド

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Move workloads away from secret-backed environment variables and toward file-based secret delivery through mounted volumes, preferably using the Azure Key Vault provider for Secrets Store CSI Driver. In AKS, mounted secrets support sync and autorotation, while secrets exposed through environment variables do not update in running pods until those pods are restarted. 1. Identify workloads that use secretKeyRef or envFrom.secretRef and classify them for migration. 2. Replace environment-variable injection with mounted secret files, ideally through SecretProviderClass and the Secrets Store CSI Driver. 3. Enable secret autorotation where supported so mounted content and synced Kubernetes Secrets are refreshed automatically. 4. Update the application to read secrets from the mounted path and reload them from file when values change.

プロパティ

オペレーティングシステム: すべて
タグ: akspoliciessecrets
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.5.1 Prefer exposing secrets as mounted files rather than environment variables

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target aks --level 2