whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #24930 from adamhjk/patch-1

Browse Source 
Explain the insecure by default nature of secrets
This commit is contained in:
Kubernetes Prow Robot
2021-01-16 19:47:43 -08:00
committed by GitHub
parent 491790039e f2a9a3ef81
commit 216ca3f06b
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/configuration/secret.md
+10
View File
@@ -24,6 +24,16 @@ a password, a token, or a key. Such information might otherwise be put in a
Pod specification or in an image. Users can create Secrets and the system Pod specification or in an image. Users can create Secrets and the system
also creates some Secrets. also creates some Secrets.
{{< caution >}}
Kubernetes Secrets are, by default, stored as unencrypted base64-encoded
strings. By default they can be retrieved - as plain text - by anyone with API
access, or anyone with access to Kubernetes' underlying data store, etcd. In
order to safely use Secrets, we recommend you (at a minimum):
1. [Enable Encryption at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for Secrets.
2. [Enable RBAC rules that restrict reading and writing the Secret](https://kubernetes.io/docs/reference/access-authn-authz/authorization/). Be aware that secrets can be obtained implicitly by anyone with the permission to create a Pod.
{{< /caution >}}
<!-- body --> <!-- body -->
## Overview of Secrets ## Overview of Secrets