cyber.hendryadrian.com
Security Insights · securitylabs.datadoghq.com

Kubernetes Secrets: Threat Models, Risks, and Protection Options

· Original article ↗

Summary

An explainer of Kubernetes secrets risks and protections covers storage in etcd and on worker nodes, exposure through APIs and workloads, and tradeoffs among Secret objects, mounted files, encryption, RBAC, and external providers.

Key points

  • Kubernetes Secret data is stored in etcd and can also reside on worker nodes; base64 encoding is not encryption.
  • Mounted secret files may reduce exposure compared with environment variables, which can be captured during debugging.
  • Users or service accounts with list or watch rights can access secret contents; anyone able to create pods in a namespace can access its secrets.
  • Arbitrary hostPath mounts can expose secret volumes belonging to other containers on the same node.
  • At-rest encryption can help protect etcd data and backups, but may offer less protection when the API server and etcd share a node.
  • The article describes a 2023 critical CVE in the RKE distribution involving sensitive data stored in a ConfigMap, without specifying its identifier.
  • External secret providers may add granular access controls, auditing, or hardware-backed encryption, but require additional management and may incur costs.

Article Details

Topic
Kubernetes secrets management: threat models, access controls, and protection of secrets at rest and in transit

MITRE ATT&CK

T1005 · Data from Local SystemAn attacker who gains access to etcd hosts, node operating systems, disks, or backups could extract stored secrets.T1040 · Network SniffingSecrets in transit could be intercepted by monitoring traffic between Kubernetes components; the article notes that such traffic is encrypted by default.T1552 · Unsecured CredentialsKubernetes secrets may be exposed when access controls fail, including through secret storage or API permissions that allow access to secret contents.T1613 · Container and Resource DiscoveryListing Kubernetes secrets can reveal their contents, including through the demonstrated command kubectl get secrets -o yaml.

Products

etcdIt also highlights practical security tradeoffs such as environment variables versus mounted files, RBAC limitations, etcd encryption, and risks like storing sensitive data in ConfigMaps.KubernetesThis article explains Kubernetes secrets management, focusing on the main threat models for secrets at rest, in transit, and through API abuse, as well as how native Secret objects and external solutions address them.

Related Articles