Merge pull request #24930 from adamhjk/patch-1

Explain the insecure by default nature of secrets
2021-01-16 19:47:43 -08:00
parent 491790039e f2a9a3ef81
commit 216ca3f06b
1 changed files with 10 additions and 0 deletions
@@ -24,6 +24,16 @@ a password, a token, or a key. Such information might otherwise be put in a
 Pod specification or in an image. Users can create Secrets and the system
 also creates some Secrets.
 {{< caution >}}
 Kubernetes Secrets are, by default, stored as unencrypted base64-encoded
 strings. By default they can be retrieved - as plain text - by anyone with API
 access, or anyone with access to Kubernetes' underlying data store, etcd. In
 order to safely use Secrets, we recommend you (at a minimum):
 1. [Enable Encryption at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for Secrets.
 2. [Enable RBAC rules that restrict reading and writing the Secret](https://kubernetes.io/docs/reference/access-authn-authz/authorization/). Be aware that secrets can be obtained implicitly by anyone with the permission to create a Pod.
 {{< /caution >}}
 <!-- body -->
 ## Overview of Secrets