{
  "id": "security/kubernetes-secret-etcd-plaintext",
  "signature": "Kubernetes secret is stored in plaintext in etcd",
  "signature_zh": "Kubernetes 密钥以明文形式存储在 etcd 中",
  "regex": "secret.*(?:plaintext|unencrypted|etcd)",
  "domain": "security",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "Kubernetes secrets are base64-encoded but not encrypted at rest in etcd unless encryption at rest is configured, exposing sensitive data to anyone with etcd access.",
  "root_cause_type": "generic",
  "root_cause_zh": "Kubernetes 密钥是 base64 编码的，但除非配置了静态加密，否则在 etcd 中不会加密存储，任何有权访问 etcd 的人都会暴露敏感数据。",
  "versions": [
    {
      "version": "Kubernetes 1.24",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Kubernetes 1.28",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "etcd 3.5",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Setting base64 encoding as encryption is a common misconception; base64 is not encryption and can be trivially decoded.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Using network policies to restrict etcd access doesn't protect against attackers who compromise a pod with etcd access.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Deleting the secret from etcd without cleaning up backups leaves the plaintext data in backup snapshots.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`.",
      "success_rate": 0.85,
      "how": "Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd.",
      "success_rate": 0.9,
      "how": "Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections.",
      "success_rate": 0.6,
      "how": "Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "为 Kubernetes 密钥启用静态加密。编辑 kube-apiserver 配置，添加包含 `aescbc` 等提供程序的 EncryptionConfiguration 文件。示例：`--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`。",
    "使用外部密钥管理系统，如 HashiCorp Vault 或 AWS Secrets Manager，并在应用程序中引用它们，而不是将密钥存储在 etcd 中。",
    "将 etcd 访问限制为仅控制平面节点，并对所有 etcd 连接使用 TLS 客户端认证。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.8,
  "resolvable": "partial",
  "first_seen": "2023-05-22",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}