Prefer using secrets as files over secrets as environment variables

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Update workloads to avoid passing secrets through environment variables. Prefer direct Secret Manager API access through Workload Identity Federation for GKE and Google Cloud client libraries. This keeps sensitive data outside cluster storage, avoids long lived service account keys, and uses IAM rather than in cluster RBAC for Secret Manager access. • Modify application code to read secrets from Secret Manager API where possible. • Use a dedicated Kubernetes ServiceAccount for each workload identity that needs Secret Manager access. • Grant only the required Secret Manager IAM permissions to that workload identity. • When code cannot call the API directly, use the Secret Manager add-on to mount secrets as files in the Pod file system. • Remove secretKeyRef and secretRef environment variable usage from workload manifests after the new access pattern is validated.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target gke --level 2