RBAC Role has Secret-read permissions

Description

When a Role or ClusterRole grants get, list or watch on secrets and is bound to an identity, that identity can read Secret data within the granted scope. Listing and watching can also return Secret values. Secrets often contain passwords, tokens, certificates and keys, making disclosure consequential.

Grant narrowly scoped access to operators and applications only when it is needed.

Potential impact

Sensitive passwords, tokens and keys can be disclosed.
Stolen credentials can allow compromise to spread to other systems.

Remediation

Remove unnecessary get, list, watch and wildcard permissions on secrets.
Limit access to required namespaces and identities, and review the actual RoleBindings and ClusterRoleBindings.

Examples

These examples compare Role rules only. Actual access requires a separate binding; use the after-example Pod-read permissions only when needed.

Before

hcl

resource "kubernetes_role" "role" {
  metadata {
    name = "terraform-example"
  }

  rule {
    api_groups = [""]
    resources  = ["secrets"]
    verbs      = ["get", "list", "watch"]
  }
}

After

hcl

resource "kubernetes_role" "role" {
  metadata {
    name = "terraform-example"
  }

  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "list", "watch"]
  }
}

Explanation:

Before: Secret-read permissions are defined.
After: Secret permissions are removed and only Pod-read permissions are defined.