whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28805 from YuvalAvra/remove-secrets-node-risk

Browse Source 
Remove an outdated risk regarding node permissions over secrets
This commit is contained in:
Kubernetes Prow Robot
2021-07-06 01:22:18 -07:00
committed by GitHub
parent 792093b37c 338139971f
commit a909bd7a74
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/configuration/secret.md
-4
View File
@@ -1235,10 +1235,6 @@ for secret data, so that the secrets are not stored in the clear into {{< glossa
- A user who can create a Pod that uses a secret can also see the value of that secret. Even - A user who can create a Pod that uses a secret can also see the value of that secret. Even
if the API server policy does not allow that user to read the Secret, the user could if the API server policy does not allow that user to read the Secret, the user could
run a Pod which exposes the secret. run a Pod which exposes the secret.
- Currently, anyone with root permission on any node can read _any_ secret from the API server,
by impersonating the kubelet. It is a planned feature to only send secrets to
nodes that actually require them, to restrict the impact of a root exploit on a
single node.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}