Minimize Access To Secrets

Manual Steps

Identify which subjects currently have broad Secret access

Run on any machine with kubectl access:

kubectl get clusterrole,role -A -o yaml | grep -nA5 -B3 "resources:.*secrets"

kubectl get clusterrolebinding,rolebinding -A -o yaml | grep -nA8 -B3 "roleRef:"

List the ClusterRoles/Roles that grant get, list, or watch on Secrets

Run:

kubectl get clusterrole,role -A -o json \
  | jq -r '.items[]
    | select(.rules != null)
    | select([.rules[]
        | select(.resources != null)
        | select(.resources|index("secrets"))
        | select(.verbs|map(.=="get" or .=="list" or .=="watch")|any)
      ]|length>0)
    | (.kind + "/" + .metadata.name + " (ns: " + (.metadata.namespace // "cluster-scope") + ")")'

Review and edit roles to remove or narrow Secret access
- For each non-system role you decide should not have broad Secret access, edit it:
  kubectl edit clusterrole <clusterrole-name>
  or for a namespace-scoped role:
  kubectl edit role <role-name> -n <namespace>
- In the opened YAML, locate rules: entries with resources: ["secrets"] (or including secrets) and:
  - Remove the get, list, and watch verbs from verbs:, or
  - Remove the entire rule if no longer needed.
- Save and exit to apply.
Adjust bindings so only intended subjects keep Secret access
- For roles/clusterroles where some Secret access is still required but only for a limited group, edit bindings:
  kubectl edit clusterrolebinding <binding-name>
  or
  kubectl edit rolebinding <binding-name> -n <namespace>
- Under subjects:, remove users/groups/serviceaccounts that should not be able to access Secrets.
- Save and exit.
Re-test access for specific identities before global verification
- For high‑risk groups (for example system:authenticated or a CI user), explicitly test:
  kubectl auth can-i get,list,watch secrets --all-namespaces --as=<user-or-group>
- Confirm it returns no for identities that should not have cluster‑wide Secret read access.

Verification (derived from the audit command)

Run on any machine with kubectl access:

echo "canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)"

Confirm the output shows:

canGetListWatchSecretsAsSystemAuthenticated: no

Using kubectl

# 1) Identify which ClusterRoles currently allow get/list/watch on secrets
# Run on: any machine with kubectl access
kubectl get clusterrole -o json \
  | jq -r '
    .items[]
    | select(
        .rules[]
        | select(
            (.resources // []) | index("secrets")
            and ((.verbs // []) | (.[] | IN("get","list","watch")))
        )
      )
    | .metadata.name
  ' | sort -u

# 2) Inspect each identified ClusterRole to decide if it truly needs secret read access
# Replace <clusterrole-name> with each name from the previous command.
kubectl get clusterrole <clusterrole-name> -o yaml

# 3) Edit ClusterRoles to remove get/list/watch on secrets where not required
# Example: remove only the secret-related verbs, keep others.
# Run once per ClusterRole you’ve decided should not read secrets.

# This opens your editor; adjust the 'rules' section to drop get/list/watch from
# any entry where 'resources: ["secrets"]' (or includes "secrets").
kubectl edit clusterrole <clusterrole-name>

# 4) For fine-grained control, split secret access into a dedicated ClusterRole (optional)
# Run on: any machine with kubectl access

# Create a narrow-scope ClusterRole that allows only what is actually needed;
# adjust namespaces and subjects before applying.
cat << 'EOF' > readonly-secrets-narrow-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly-secrets-narrow
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]   # Remove "list","watch" unless absolutely necessary
EOF

kubectl apply -f readonly-secrets-narrow-clusterrole.yaml

# Example: bind this narrowly to a specific service account instead of broad groups
cat << 'EOF' > readonly-secrets-narrow-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: readonly-secrets-narrow-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: readonly-secrets-narrow
subjects:
- kind: ServiceAccount
  name: my-workload-sa
  namespace: default
EOF

kubectl apply -f readonly-secrets-narrow-binding.yaml

# 5) Verification: confirm system:authenticated can no longer get/list/watch secrets cluster-wide
# Run on: any machine with kubectl access
kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated

Automation

#!/usr/bin/env bash
#
# Minimize access to Secrets for system:authenticated
#
# Scope: any machine with kubectl access and current-context pointing to the target cluster.
# Requirements: kubectl, cluster-admin (or equivalent) privileges.

set -euo pipefail

echo "=== Checking current access for system:authenticated to secrets ==="
CURRENT_ACCESS=$(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated || echo "error")
echo "canGetListWatchSecretsAsSystemAuthenticated: ${CURRENT_ACCESS}"

echo "=== Enumerating RBAC bindings granting get/list/watch on secrets to system:authenticated ==="

# Temporary files
TMP_CLUSTERROLES=$(mktemp)
TMP_ROLES=$(mktemp)
trap 'rm -f "$TMP_CLUSTERROLES" "$TMP_ROLES"' EXIT

# 1) Find ClusterRoles that grant get/list/watch on secrets
kubectl get clusterroles -o json > "${TMP_CLUSTERROLES}"

echo "- ClusterRoles with get/list/watch on secrets:"
jq -r '
  .items[]
  | select(
      (.rules // [])
      | map(
          (.resources // [] | index("secrets")) and
          (.verbs // [] | (index("get") or index("list") or index("watch")))
        )
      | any
    )
  | .metadata.name
' "${TMP_CLUSTERROLES}" | sort -u || true

CLUSTERROLES_WITH_SECRET_ACCESS=$(jq -r '
  .items[]
  | select(
      (.rules // [])
      | map(
          (.resources // [] | index("secrets")) and
          (.verbs // [] | (index("get") or index("list") or index("watch")))
        )
      | any
    )
  | .metadata.name
' "${TMP_CLUSTERROLES}" | sort -u)

# 2) Find Roles that grant get/list/watch on secrets
kubectl get roles --all-namespaces -o json > "${TMP_ROLES}"

echo "- Namespaced Roles with get/list/watch on secrets:"
jq -r '
  .items[]
  | select(
      (.rules // [])
      | map(
          (.resources // [] | index("secrets")) and
          (.verbs // [] | (index("get") or index("list") or index("watch")))
        )
      | any
    )
  | (.metadata.namespace + "/" + .metadata.name)
' "${TMP_ROLES}" | sort -u || true

ROLES_WITH_SECRET_ACCESS=$(jq -r '
  .items[]
  | select(
      (.rules // [])
      | map(
          (.resources // [] | index("secrets")) and
          (.verbs // [] | (index("get") or index("list") or index("watch")))
        )
      | any
    )
  | (.metadata.namespace + "/" + .metadata.name)
' "${TMP_ROLES}" | sort -u)

echo "=== Enumerating bindings that attach those roles to system:authenticated ==="

echo "- ClusterRoleBindings to system:authenticated that use affected ClusterRoles:"
kubectl get clusterrolebindings -o json \
  | jq -r --argjson crn "[\"$(echo "${CLUSTERROLES_WITH_SECRET_ACCESS}" | paste -sd '","' -)\"]" '
      .items[]
      | select(
          (.roleRef.kind == "ClusterRole")
          and ((.roleRef.name) as $rname | ($crn | index($rname)))
          and (
            (.subjects // [])
            | map(.kind == "Group" and .name == "system:authenticated")
            | any
          )
        )
      | .metadata.name
    ' | sort -u || true

CLUSTERROLEBINDINGS_TO_SYSTEM_AUTH=$(kubectl get clusterrolebindings -o json \
  | jq -r --argjson crn "[\"$(echo "${CLUSTERROLES_WITH_SECRET_ACCESS}" | paste -sd '","' -)\"]" '
      .items[]
      | select(
          (.roleRef.kind == "ClusterRole")
          and ((.roleRef.name) as $rname | ($crn | index($rname)))
          and (
            (.subjects // [])
            | map(.kind == "Group" and .name == "system:authenticated")
            | any
          )
        )
      | .metadata.name
    ' | sort -u)

echo "- RoleBindings to system:authenticated that use affected Roles:"
kubectl get rolebindings --all-namespaces -o json \
  | jq -r --argjson rn "[\"$(echo "${ROLES_WITH_SECRET_ACCESS}" | paste -sd '","' -)\"]" '
      .items[]
      | select(
          (.roleRef.kind == "Role")
          and ((.metadata.namespace + "/" + .roleRef.name) as $rname | ($rn | index($rname)))
          and (
            (.subjects // [])
            | map(.kind == "Group" and .name == "system:authenticated")
            | any
          )
        )
      | (.metadata.namespace + "/" + .metadata.name)
    ' | sort -u || true

ROLEBINDINGS_TO_SYSTEM_AUTH=$(kubectl get rolebindings --all-namespaces -o json \
  | jq -r --argjson rn "[\"$(echo "${ROLES_WITH_SECRET_ACCESS}" | paste -sd '","' -)\"]" '
      .items[]
      | select(
          (.roleRef.kind == "Role")
          and ((.metadata.namespace + "/" + .roleRef.name) as $rname | ($rn | index($rname)))
          and (
            (.subjects // [])
            | map(.kind == "Group" and .name == "system:authenticated")
            | any
          )
        )
      | (.metadata.namespace + "/" + .metadata.name)
    ' | sort -u)

echo "=== REVIEW REQUIRED (MANUAL CONTROL) ==="
echo "This control is MANUAL. There is no safe automatic edit of RBAC without human review."
echo
echo "1) Review the listed ClusterRoles and Roles and determine:"
echo "   - Which uses of get/list/watch on secrets are strictly required."
echo "   - Whether they must apply to the broad group system:authenticated."
echo
echo "2) For each binding below that is NOT required, you may remove system:authenticated"
echo "   from subjects or replace it with a narrower group/service account."
echo
echo "ClusterRoleBindings to review (cluster-wide effect):"
echo "${CLUSTERROLEBINDINGS_TO_SYSTEM_AUTH:-<none>}"
echo
echo "RoleBindings to review (namespaced effect):"
echo "${ROLEBINDINGS_TO_SYSTEM_AUTH:-<none>}"
echo
echo "To edit a binding, run for each chosen binding:"
echo "  # Example: edit ClusterRoleBinding"
echo "  kubectl edit clusterrolebinding <clusterrolebinding-name>"
echo
echo "  # Example: edit RoleBinding in a namespace"
echo "  kubectl edit rolebinding <rolebinding-name> -n <namespace>"
echo
echo "In the opened YAML, locate subjects: and remove or replace entries like:"
echo "  - kind: Group"
echo "    name: system:authenticated"
echo
read -r -p "Press Enter after you have completed RBAC edits to re-check access, or Ctrl+C to abort... " _

echo "=== Re-checking access for system:authenticated to secrets after RBAC review ==="
FINAL_ACCESS=$(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated || echo "error")
echo "canGetListWatchSecretsAsSystemAuthenticated: ${FINAL_ACCESS}"

echo "=== Completed. ==="

Kubernetes

Kubernetes Misconfigurations

Minimize Access To Secrets

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation