Secrets used as environment variables misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_35
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Secrets can be mounted as data volumes or exposed as environment variables and used by a container in a pod to interact with external systems on your behalf. Secrets can also be used by other parts of the system, without being directly exposed to the pod. Benefits for storing secrets as files include: setting file permissions, projects of secret keys to specific paths, and consuming secret values from volumes.

How to Fix

Resource: Container

• Arguments: env:valueFrom:secretKeyRef - uses a secret in an environment variable in a Pod envFrom:secretRef - defines all of the secret's data as the container environment variables [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: env:
• name: valueFrom:
• secretKeyRef:
• name:
• key:

---

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: envFrom:
• • secretRef:
• name:

---