<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: securing-kubernetes-secrets
description: >-
  Secure Kubernetes secrets through encryption at rest, external secret management
  with Vault and AWS Secrets Manager, CSI secret store drivers, RBAC restrictions,
  and detection of secret exposure in etcd, environment variables, and logs.
domain: cybersecurity
subdomain: container-security
tags:
  - kubernetes-secrets
  - vault
  - encryption-at-rest
  - csi-driver
  - etcd
  - secret-management
  - aws-secrets-manager
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.007"]
---

# Securing Kubernetes Secrets

## Overview

Kubernetes secrets are base64-encoded by default, not encrypted, and stored in
etcd in plaintext unless encryption at rest is configured. This skill covers
hardening secret storage with etcd encryption, integrating external secret managers
(HashiCorp Vault, AWS Secrets Manager), using the Secrets Store CSI Driver,
restricting RBAC access to secrets, and detecting secret exposure.

Mode: `[MODE: BLUE]` — Defensive secret management hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster with etcd access or managed K8s (EKS/AKS/GKE) | Required |
| `kubectl` with admin permissions to read/modify encryption configuration | Required |
| Optional | HashiCorp Vault >= 1.15 or AWS Secrets Manager access |
| Secrets Store CSI Driver >= 1.4 | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/securing-kubernetes-secrets-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/securing-kubernetes-secrets-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/securing-kubernetes-secrets-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Securing Kubernetes Secrets Detection
id: 13756bc1-7390-491a-9f75-28244ec10d8a
status: experimental
description: Detects suspicious activity related to securing kubernetes secrets techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1552.007
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Securing Kubernetes Secrets Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1552.007 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
- [Encrypting Secret Data at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)
- [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/)
- [External Secrets Operator](https://external-secrets.io/)
