Title

Secrets in Kubernetes must not be stored as environment variables. (Cat I impact)

Discussion

Secrets, such as passwords, keys, tokens, and certificates should not be stored as environment variables. These environment variables are accessible inside Kubernetes by the "Get Pod" API call, and by any system, such as CI/CD pipeline, which has access to the definition file of the container. Secrets must be mounted from files or stored within password vaults.

Check Content

On the Kubernetes Control Plane, run the following command: kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A If any of the values returned reference environment variables, this is a finding.

Fix Text

Any secrets stored as environment variables must be moved to the secret files with the proper protections and enforcements or placed within a password vault.

Additional Identifiers

Rule ID: SV-242415r879608_rule

Vulnerability ID: V-242415

Group Title: SRG-APP-000171-CTR-000435

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.