Vaults secrets injected by vault sidecar container inside the pod are visible to kubernetes cluster users/admin

Question

I have integrated the external vault into kubernetes cluster. Vault is injecting the secrets into shared volume “/vault/secrets” inside the pod which can be consumed by application container. Till now everything looks good.

But I can see security risk by inserting the secrets into shared volume in plain text as anyone can access the application secrets who has access to the kubernetes cluster.

Example: Secrets are injected into shared volume at /vault/secrets/config

Now, If kubernetes cluster admin logged in and he can access the pod along with credentials available at the shared volume in plain text format.

Kubectl exec -it <pod> command will be used to enter into pod.

In this case, my concern is cluster admin can access the application secrets (Ex: database passwords) which is security risk. In my scenario vault admin is different and kubernetes cluster admin is different.

Answer 1

Having a shared volume available to all pods in a cluster where all the secrets are stored in plain-text doesn't sound too secure to be honest. You could improve the securtity a little bit (only a little bit) by defining the use-limit (num_uses token attribute) to 1 (one) and alerting whenever legitimate application (that is the one that the secret was intended for) gets token invalid error messege. I'm a K8s noob but how about this guide: https://cloud.redhat.com/blog/integrating-hashicorp-vault-in-openshift-4 I know it's for RH OSE but maybe the concept sparks an idea.