Detections
Analytics
4.4.1 Use Secret Manager for external workload secret storage
Information
Use Secret Manager as the preferred external storage and management service for workload secrets used by GKE Autopilot clusters. Workloads should access secrets through Secret Manager API calls using Workload Identity Federation for GKE, or through mounted volumes using the Secret Manager add-on when file based access is required.Kubernetes Secrets are supported, but they require careful control through Kubernetes RBAC, namespace boundaries, encryption, and workload configuration. Storing sensitive values in Secret Manager centralizes secret lifecycle management outside the cluster and supports IAM based access control, auditability, rotation, and version management. Workload Identity Federation for GKE lets workloads access Secret Manager without static service account keys and allows access to be granted to specific Kubernetes ServiceAccounts.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Move externally managed workload secrets to Secret Manager and update GKE workloads to access them through Workload Identity Federation for GKE. Prefer direct Secret Manager API access through Google Cloud client libraries where the application supports it. For applications that require file based secret access, enable the Secret Manager add-on and mount secrets into Pods using SecretProviderClass and CSI volumes.-
Configure applications to use Workload Identity Federation for GKE for Secret Manager access.
-
Use dedicated Kubernetes ServiceAccounts for workloads that need Secret Manager access.
-
Grant least privilege Secret Manager IAM permissions only to the required workload identities.
-
Enable the Secret Manager add-on when workloads need secrets mounted as files.
-
Migrate sensitive values out of Kubernetes Secrets where practical, then remove unused in-cluster Secret objects.
Secret Manager provides centralized secret management features such as fine grained access control, managed rotation, lifecycle management, and audit logs.
Impact:
Applications might require code, deployment, or configuration changes to retrieve secrets from Secret Manager or mounted files instead of relying directly on Kubernetes Secrets. Admins must configure applications to use Workload Identity Federation for GKE, grant the correct IAM permissions to the workload identity, validate secret access during startup and rotation, and update operational procedures for versioning, access review, and troubleshooting.
See Also
Item Details
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(10), CSCv7|13
Plugin: GCP
Control ID: 7881a50216aea8268c8c71e177ff5a004a4c59280c8abf1b54124a5d43a8d2b6