Sign in

Secrets as Files, Not Environment Variables

easy 10 XP ~7 minHands-on lab

barcode in audit gets its database credentials from the Secret barcode-db through environment variables. Environment variables leak: into crash reports, /proc/<pid>/environ, debug endpoints and child processes. The app also supports reading the password from a file.

Task

  • No container of barcode gets a value of the Secret through environment variables anymore (neither env nor envFrom).
  • The Secret's password key, and only that key, is mounted read-only at /etc/db/password, with file mode 0400.
  • The app finds it through the environment variable DB_PASSWORD_FILE=/etc/db/password.
  • barcode keeps running (as UID 1000, as now).

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

ckssecretsvolumesckad
TerminalNot started

Your machine is ready to start

Create a free account to open a machine and get graded.