The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions.
Secrets Service Integration
CCC.K8S.CP12
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH03 | Long-Lived Credentials are Exposed to Workloads | Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls. |
| CCC.K8S.TH07 | Secrets are Exposed to Unauthorized Workloads | Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect. |