whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove an outdated risk regarding secrets

Browse Source
This commit is contained in:
Yuval Avrahami
2021-07-05 20:42:08 +03:00
parent 1d89bc1763
commit 338139971f
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/configuration/secret.md
-4
View File
@@ -1235,10 +1235,6 @@ for secret data, so that the secrets are not stored in the clear into {{< glossa
- A user who can create a Pod that uses a secret can also see the value of that secret. Even - A user who can create a Pod that uses a secret can also see the value of that secret. Even
if the API server policy does not allow that user to read the Secret, the user could if the API server policy does not allow that user to read the Secret, the user could
run a Pod which exposes the secret. run a Pod which exposes the secret.
- Currently, anyone with root permission on any node can read _any_ secret from the API server,
by impersonating the kubelet. It is a planned feature to only send secrets to
nodes that actually require them, to restrict the impact of a root exploit on a
single node.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}