From 8b11f9ac40f13ed92c5f4671ce1fb28f22286a55 Mon Sep 17 00:00:00 2001 From: Ahmet Alp Balkan Date: Wed, 17 May 2017 13:34:29 -0700 Subject: [PATCH] secret.md: add base64 risk (#3791) * secret.md: add base64 risk Solves #3681. Signed-off-by: Ahmet Alp Balkan * Update secret.md --- docs/concepts/configuration/secret.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/concepts/configuration/secret.md b/docs/concepts/configuration/secret.md index ef52bb423d..c35e59e6d2 100644 --- a/docs/concepts/configuration/secret.md +++ b/docs/concepts/configuration/secret.md @@ -805,6 +805,10 @@ Pod level](#use-case-secret-visible-to-one-container-in-a-pod). - Administrators should limit access to etcd to admin users - Secret data in the API server is at rest on the disk that etcd uses; admins may want to wipe/shred disks used by etcd when no longer in use + - If you configure the secret through a manifest (JSON or YAML) file which has + the secret data encoded as base64, sharing this file or checking it in to a + source repository means the secret is compromised. Base64 encoding is not an + encryption method and is considered the same as plain text. - Applications still need to protect the value of secret after reading it from the volume, such as not accidentally logging it or transmitting it to an untrusted party. - A user who can create a pod that uses a secret can also see the value of that secret. Even