Protect workload secrets through encrypted handling, narrow authorization, and removal from images and non-secret configuration objects.
Protect Workload Secrets
CCC.K8S.CN07 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP11 | Workload Identity Federation | The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads. |
| CCC.K8S.CP12 | Secrets Service Integration | The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH03 | Long-Lived Credentials are Exposed to Workloads | Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls. |
| CCC.K8S.TH07 | Secrets are Exposed to Unauthorized Workloads | Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN07.AR01 | Secret material used by a workload MUST be encrypted during storage and delivery, MUST be accessible only to the intended workload identity, and MUST NOT be embedded in a container image or non-secret configuration resource. | tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN07.AR02 | When Kubernetes secret access is granted, workload roles MUST be limited to the required named secrets and MUST NOT grant unrestricted list or watch access. | tlp-clear, tlp-green, tlp-amber, tlp-red |