auditing-workload-secret-exposure-surface

Auditing workload secret exposure surface: who else can read this secret

A secret a workload needs is safe only if nothing beyond the intended consumer can read it, and containerized delivery quietly widens that set. An environment variable is inherited by every child process, echoed by many debug and introspection endpoints, and captured in crash dumps and process listings, so an env secret is readable by far more than the code that meant to use it. A mounted secret file is readable by every container in the pod that shares the mount, so a sidecar becomes a reader. A secret that lands in a log line or an error message is exposed to whoever reads logs, which is usually a much broader audience than whoever holds the secret. And the orchestrator's secret object is readable by every identity its access rules admit, often more service accounts than the one workload. The audit is not whether the secret exists but who else can see it. You audit this by tracing each secret from its store into the workload and enumerating every other reader.

When to use

• Workloads consume secrets through environment variables, mounted files, or the orchestrator's secret store.
• Sidecars, child processes, debug endpoints, or logs may be able to read a secret meant for one consumer.
• A secret object may be readable by more identities or service accounts than the single workload that needs it.

Scope check

Audit secret exposure only for workloads and clusters you own or are authorized to assess, on non-production secrets. Confirming exposure means reading a real secret through the exposing path, so use non-production credentials and never exfiltrate or reuse a secret you surface. If you can't name the authorization, stop.

The loop

1. Establish the intended consumer first. Name, for each secret, the single process or workload that is supposed to read it and nothing else. This is the false-positive killer: a secret delivered as a file mounted only into the one container that needs it, with the secret object readable by only that workload's service account, is correctly scoped. Name the intended consumer, then enumerate every other reader.