From 338139971f212a96953f6a75bf7260d13257079c Mon Sep 17 00:00:00 2001 From: Yuval Avrahami Date: Mon, 5 Jul 2021 20:42:08 +0300 Subject: [PATCH] Remove an outdated risk regarding secrets --- content/en/docs/concepts/configuration/secret.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index 48ac53ed47..933d30918b 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -1235,10 +1235,6 @@ for secret data, so that the secrets are not stored in the clear into {{< glossa - A user who can create a Pod that uses a secret can also see the value of that secret. Even if the API server policy does not allow that user to read the Secret, the user could run a Pod which exposes the secret. - - Currently, anyone with root permission on any node can read _any_ secret from the API server, - by impersonating the kubelet. It is a planned feature to only send secrets to - nodes that actually require them, to restrict the impact of a root exploit on a - single node. ## {{% heading "whatsnext" %}}