Mount secrets as files instead of environment variables

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review workload manifests and identify any Pod, Deployment, DaemonSet, StatefulSet, Job, or CronJob that exposes secrets through environment variables instead of mounted files. Check for both direct secret references through env[].valueFrom.secretKeyRef and bulk secret imports through envFrom[].secretRef, because either pattern exposes secret data as environment variables. Prefer workloads that consume secrets through mounted Secret volumes or file delivery from AWS secrets integrations instead.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Update workloads to consume secrets as mounted files instead of environment variables. Replace env[].valueFrom.secretKeyRef and envFrom[].secretRef usage with Kubernetes Secret volumes or the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, and then update the application to read the secret from the mounted file path. This reduces the chance of secret values appearing in logs and aligns with the recommended file delivery pattern for EKS workloads. For Kubernetes Secrets, mount the Secret as a volume and update the application configuration to read from the mounted path rather than from environment variables.