Secret Exposed as Environment Variable

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-data-002
  labels:
    severity: "high"
    category: "data"
  annotations:
    rules.spotter.dev/title: "Secret Exposed as Environment Variable"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-522"
    rules.spotter.dev/description: "Exposing secrets as environment variables can be risky, as they can be easily exposed through logs or other means."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - ""
          - "apps"
        versions:
          - "v1"
        kinds:
          - Pod
          - Deployment
          - StatefulSet
          - DaemonSet
          - Job
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    (object.kind == 'Pod' && has(object.spec.containers) && object.spec.containers.exists(c,
      (has(c.env) && c.env.exists(e, has(e.valueFrom) && has(e.valueFrom.secretKeyRef))) ||
      (has(c.envFrom) && c.envFrom.exists(ef, has(ef.secretRef)))
    )) ||
    (object.kind != 'Pod' && has(object.spec.template.spec.containers) && object.spec.template.spec.containers.exists(c,
      (has(c.env) && c.env.exists(e, has(e.valueFrom) && has(e.valueFrom.secretKeyRef))) ||
      (has(c.envFrom) && c.envFrom.exists(ef, has(ef.secretRef)))
    ))
  remediation:
    manual: "Use a volume to mount the secret into the pod instead of exposing it as an environment variable."
  references:
    - title: "Kubernetes Secrets"
      url: "https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: secret-env-pod
    spec:
      containers:
      - name: mycontainer
        image: redis
        env:
          - name: SECRET_USERNAME
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: username
          - name: SECRET_PASSWORD
            valueFrom:
              secretKeyRef:
                name: mysecret
                key: password
      restartPolicy: Never

- name: insecure sample 2 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: envfrom-secret
    spec:
      containers:
      - name: envars-test-container
        image: nginx
        envFrom:
        - secretRef:
            name: test-secret

- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: secret-env-pod
    spec:
      containers:
      - name: mycontainer
        image: redis
      restartPolicy: Never

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-data-002
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-data-002
spec:
  # Add your VAP configuration here

Rule Metadata

Secret Exposed as Environment Variable

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub