Homepage
About Snyk

Roles and cluster roles should not grant 'get', 'list', or 'watch' permissions for secrets Affecting Service service in Kubernetes

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Containers / Best Practices

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Kubernetes
  • Snyk ID SNYK-CC-00651
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Roles and cluster roles should not grant 'get', 'list', or 'watch' permissions for secrets. RBAC resources in Kubernetes are used to grant access to get, list, and watch secrets on the Kubernetes API. Restrict use of these permissions to the smallest set of users and service accounts as possible.

How to fix?

Set the verbs attribute in Role and ClusterRole to a value other than "get", "list", or "watch" where resources is set to secrets.

Example Configuration

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-access-role
rules:
- apiGroups: [""] 
  resources: ["secrets"]
  verbs: ["create", "update", "delete", "patch"]

--- 

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-access-cluster-role
rules:
- apiGroups: [""] 
  resources: ["secrets"]
  verbs: ["create", "update", "delete", "patch"]