Prefer exposing secrets as mounted files rather than environment variables

Trung bìnhCấp 2Tự độngaks

Mô tả

Prefer exposing secrets to AKS workloads as mounted files rather than as environment variables, particularly when secrets are sourced from Azure Key Vault through the Secrets Store CSI Driver. In current AKS guidance, the Key Vault integration model is volume-based, with secrets made available at a mounted path inside the container, and Microsoft documents that mounted content can be synchronized and rotated through the CSI provider. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports containers using env valueFrom.secretKeyRef or envFrom.secretRef.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Move workloads away from secret-backed environment variables and toward file-based secret delivery through mounted volumes, preferably using the Azure Key Vault provider for Secrets Store CSI Driver. In AKS, mounted secrets support sync and autorotation, while secrets exposed through environment variables do not update in running pods until those pods are restarted. 1. Identify workloads that use secretKeyRef or envFrom.secretRef and classify them for migration. 2. Replace environment-variable injection with mounted secret files, ideally through SecretProviderClass and the Secrets Store CSI Driver. 3. Enable secret autorotation where supported so mounted content and synced Kubernetes Secrets are refreshed automatically. 4. Update the application to read secrets from the mounted path and reload them from file when values change.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: akspoliciessecrets
Tham chiếu: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.5.1 Prefer exposing secrets as mounted files rather than environment variables

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target aks --level 2