Prefer exposing secrets as mounted files rather than environment variables

СреднийУровень 2Автоматическаяaks

Описание

Prefer exposing secrets to AKS workloads as mounted files rather than as environment variables, particularly when secrets are sourced from Azure Key Vault through the Secrets Store CSI Driver. In current AKS guidance, the Key Vault integration model is volume-based, with secrets made available at a mounted path inside the container, and Microsoft documents that mounted content can be synchronized and rotated through the CSI provider. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports containers using env valueFrom.secretKeyRef or envFrom.secretRef.

Как проверяется

Метод проверки: Команда оболочки

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Move workloads away from secret-backed environment variables and toward file-based secret delivery through mounted volumes, preferably using the Azure Key Vault provider for Secrets Store CSI Driver. In AKS, mounted secrets support sync and autorotation, while secrets exposed through environment variables do not update in running pods until those pods are restarted. 1. Identify workloads that use secretKeyRef or envFrom.secretRef and classify them for migration. 2. Replace environment-variable injection with mounted secret files, ideally through SecretProviderClass and the Secrets Store CSI Driver. 3. Enable secret autorotation where supported so mounted content and synced Kubernetes Secrets are refreshed automatically. 4. Update the application to read secrets from the mounted path and reload them from file when values change.

Свойства

Операционные системы: Любая
Теги: akspoliciessecrets
Источник: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.5.1 Prefer exposing secrets as mounted files rather than environment variables

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target aks --level 2