Detections
Analytics
CNTR-K8-001163 - Kubernetes must limit Secret access on a need-to-know basis.
Information
Kubernetes secrets may store sensitive information such as passwords, tokens, and keys. Access to these secrets should be limited to a need-to-know basis via Kubernetes RBAC.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
For Kubernetes accounts that have read access to Secrets without a documented requirement, modify the corresponding Role or ClusterRole to remove list, watch, and get privileges for Secrets.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V2R6_STIG.zip
Item Details
Audit Name: DISA Kubernetes STIG v2r6
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-28(1), CAT|II, CCI|CCI-002476, Rule-ID|SV-274884r1107245_rule, STIG-ID|CNTR-K8-001163, Vuln-ID|V-274884
Plugin: Unix
Control ID: 5f81b5ef95778b33b242dfe9de386e207c4ba8580a47a4db715b9fa9d67e2d08