SecretDecodeError security config_error ai_generated true

Kubernetes密钥因缺少Base64编码在环境变量中暴露

Kubernetes secret exposed in environment variable due to missing base64 encoding

ID: security/kubernetes-secret-exposed-in-env-var-without-encoding

其他格式: JSON · Markdown 中文 · English
95%修复率
90%置信度
1证据数
2024-01-20首次发现

版本兼容性

版本状态引入弃用备注
Kubernetes 1.24+ active — — —
kubectl 1.24.0 active — — —
Helm 3.10.0 active — — —
Minikube 1.28.0 active — — —

根因分析

Kubernetes密钥在YAML中定义时必须进行Base64编码，但开发者常忘记编码，导致明文密钥在Pod规范和日志中暴露。

English

Kubernetes secrets must be base64-encoded when defined in YAML, but developers often forget to encode the value, leaving the plaintext secret visible in the pod spec and logs.

generic

官方文档

https://kubernetes.io/docs/concepts/configuration/secret/

解决方案

  1. Always base64-encode the secret value before placing it in the YAML. For example:

echo -n 'my-secret-password' | base64
# Output: bXktc2VjcmV0LXBhc3N3b3Jk

Then use it in the Secret YAML:

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  password: bXktc2VjcmV0LXBhc3N3b3Jk
  2. Use kubectl to create secrets from literal values, which handles encoding automatically:

kubectl create secret generic my-secret --from-literal=password='my-secret-password'

This command base64-encodes the value and stores it correctly.
  3. Use external secrets management tools like HashiCorp Vault with the Kubernetes External Secrets Operator to avoid manual encoding entirely:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: password
    remoteRef:
      key: /myapp/password

无效尝试

常见但无效的做法:

  1. Use the secret value directly in the YAML without encoding, assuming Kubernetes will handle it 100% 失败

    Kubernetes requires base64-encoded values; plaintext will either cause a validation error or be stored as-is, exposing the secret.

  2. Wrap the secret value in single quotes to escape special characters 95% 失败

    Quoting does not encode the value; it only prevents YAML parsing issues but still leaves the secret in plaintext.

  3. Use a ConfigMap instead of a Secret for sensitive data 90% 失败

    ConfigMaps store data in plaintext and are not designed for secrets; this exposes the data even more.