Ensure access to Secrets is minimized and granted only where required

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Start by reviewing every path that can grant access to Kubernetes Secret objects in the OKE cluster. Start with OCI IAM access to the cluster and Kubernetes RBAC permissions, because OKE uses OCI IAM to control access to OKE and the cluster control plane, while Kubernetes RBAC controls cluster authorization. Then review Kubernetes RBAC, service account permissions, and workload identities, because OKE can combine cluster access, Kubernetes RBAC, and OCI resource access through service account based workload identity.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Start by reducing every access path that allows reading Kubernetes Secret objects in the OKE cluster. Start with OCI IAM access and Kubernetes RBAC permissions, because OCI IAM controls access to OKE and the cluster control plane, while Kubernetes RBAC controls access to Kubernetes resources such as Secrets. Then reduce unnecessary access in Kubernetes RBAC, service accounts, and workload identity policies, and replace broad permissions with the narrowest namespace or workload scope that still supports the required function. • Remove or narrow OCI IAM and Kubernetes RBAC permissions that expose Secrets, and prefer namespace access over cluster scope wherever possible. • Replace broad RBAC permissions on secrets with the smallest practical Role or ClusterRole, and remove unnecessary get, list, or watch access from users, groups, and service accounts.