List secrets used by certain pod in K8s

user_7612336 0
Viewed 2241

I'd like to know if kubectl offers an easy way to list all the secrets that a certain pod/deployment/statefulset is using, or if there is some way to cleanly retrieve this info. When doing a kubectl describe for a pod, I see I can get a list of mounted volumes which include the ones that come from secrets that I could extract using jq and the like, but this way feels a bit clumsy. I have been searching a bit to no avail. Do you know if there is anything like that around? Perhaps using the API directly?

kubernetes-secrets kubectl kubernetes
1 Answers

To List all Secrets currently in use by a pod use:

kubectl get pods -o json | jq '.items[].spec.containers[].env[]?.valueFrom.secretKeyRef.name' | grep -v null | sort | uniq

In the other hand if you want to access to stored secrets in the API:

Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that in order to safely use Secrets, take at least the following steps:

  • Enable Encryption at Rest for Secrets.
  • Enable or configure RBAC rules that restrict reading data in Secrets (including via indirect means).
  • Where appropriate, also use mechanisms such as RBAC to limit which principals are allowed to create new Secrets or replace existing
    ones.access to read any Secret in that namespace; this includes
    indirect access such as the ability to create a Deployment.

If you want more information about secrets in kubernetes, follow this link.

user_169223420
Related