SecretDecodeError security config_error ai_generated true

Kubernetes secret exposed in environment variable due to missing base64 encoding

ID: security/kubernetes-secret-exposed-in-env-var-without-encoding

Also available as: JSON · Markdown · 中文

95%Fix Rate

90%Confidence

1Evidence

2024-01-20First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
Kubernetes 1.24+	active	—	—	—
kubectl 1.24.0	active	—	—	—
Helm 3.10.0	active	—	—	—
Minikube 1.28.0	active	—	—	—

Root Cause

Kubernetes secrets must be base64-encoded when defined in YAML, but developers often forget to encode the value, leaving the plaintext secret visible in the pod spec and logs.

generic

中文

Kubernetes密钥在YAML中定义时必须进行Base64编码，但开发者常忘记编码，导致明文密钥在Pod规范和日志中暴露。

Official Documentation

https://kubernetes.io/docs/concepts/configuration/secret/

Workarounds

95% success Always base64-encode the secret value before placing it in the YAML. For example: echo -n 'my-secret-password' | base64 # Output: bXktc2VjcmV0LXBhc3N3b3Jk Then use it in the Secret YAML: apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: password: bXktc2VjcmV0LXBhc3N3b3Jk
```
Always base64-encode the secret value before placing it in the YAML. For example:

echo -n 'my-secret-password' | base64
# Output: bXktc2VjcmV0LXBhc3N3b3Jk

Then use it in the Secret YAML:

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  password: bXktc2VjcmV0LXBhc3N3b3Jk
```
90% success Use kubectl to create secrets from literal values, which handles encoding automatically: kubectl create secret generic my-secret --from-literal=password='my-secret-password' This command base64-encodes the value and stores it correctly.
```
Use kubectl to create secrets from literal values, which handles encoding automatically:

kubectl create secret generic my-secret --from-literal=password='my-secret-password'

This command base64-encodes the value and stores it correctly.
```
85% success Use external secrets management tools like HashiCorp Vault with the Kubernetes External Secrets Operator to avoid manual encoding entirely: apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: my-external-secret spec: secretStoreRef: name: vault-backend kind: SecretStore target: name: my-secret data: - secretKey: password remoteRef: key: /myapp/password
```
Use external secrets management tools like HashiCorp Vault with the Kubernetes External Secrets Operator to avoid manual encoding entirely:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: password
    remoteRef:
      key: /myapp/password
```

中文步骤

Always base64-encode the secret value before placing it in the YAML. For example:

echo -n 'my-secret-password' | base64
# Output: bXktc2VjcmV0LXBhc3N3b3Jk

Then use it in the Secret YAML:

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  password: bXktc2VjcmV0LXBhc3N3b3Jk

Use kubectl to create secrets from literal values, which handles encoding automatically:

kubectl create secret generic my-secret --from-literal=password='my-secret-password'

This command base64-encodes the value and stores it correctly.

Use external secrets management tools like HashiCorp Vault with the Kubernetes External Secrets Operator to avoid manual encoding entirely:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: password
    remoteRef:
      key: /myapp/password

Dead Ends

Common approaches that don't work:

Use the secret value directly in the YAML without encoding, assuming Kubernetes will handle it 100% fail
Kubernetes requires base64-encoded values; plaintext will either cause a validation error or be stored as-is, exposing the secret.
Wrap the secret value in single quotes to escape special characters 95% fail
Quoting does not encode the value; it only prevents YAML parsing issues but still leaves the secret in plaintext.
Use a ConfigMap instead of a Secret for sensitive data 90% fail
ConfigMaps store data in plaintext and are not designed for secrets; this exposes the data even more.