Unused Secret
Secrets are used to store sensitive data. Secrets can be used in containers as environment variables or mounted as volumes. Secrets are also used in ServiceAccounts to store the token when accessing Kubernetes API Server. This validator detects when a Secret is not mounted to a volume, not used as container environment variables and not used in any ServiceAccounts. That can be an indication of a typo in a Secret name or Secret references in volume mount, projections, environment variables or ServiceAccounts.
Affected Resources: Secret
Examples
apiVersion: v1
kind: Secret
metadata:
name: secret-foo # This Secret is not used elsewhere
data:
my-key: bXktdmFsdWU=
kind: Deployment
spec:
template:
spec:
containers:
- name: my-container
env:
- name: MY_ENV_VAR
valueFrom:
secretKeyRef:
name: secret-foo-1 # This Secret is not present
key: my-key
envFrom:
- secretRef:
name: secret-foo-2 # This Secret is not present
kind: Deployment
spec:
template:
spec:
volumes:
- name: my-secret-volume
secret:
name: secret-bar # This Secret is not present
Resolution
Learn More
Need other validation rules?
Please let us know if there are other built-in validation rules you would like to see in Kubevious to detect misconfigurations and violations to best practices. Optionally, you can provide your details so we can reach out to you with follow-up questions.