Lesson 0010 · 35 minutes · Minimize Microservice Vulnerabilities

Expose only the Secret data an application needs

Mounting a Secret is not automatically least privilege: every key becomes readable to the process. This drill combines a single-key Secret projection with the workload controls you should now retrieve from memory.

Exam reflex: secure the data path, not just the Secret object. Limit which keys are projected, where they appear, who can read them, and whether the Pod receives unrelated API credentials.

Timed task: 25 minutes

Apply lab/lesson-10-fixture.yaml. In namespace billing, create lab/lesson-10-answer.yaml from scratch containing a Pod named reconciler.

The Pod must use image busybox:1.37 with command sh -c 'sleep 3600', run as UID 1000, and satisfy all requirements below:

Mount only the api-key key from Secret billing-credentials.
Expose it as the file /var/run/credentials/api-key; the Secret’s legacy-password must not be present in the container.
Make the projected Secret volume read-only for the container.
Do not mount a ServiceAccount token.
Use RuntimeDefault seccomp, prevent privilege escalation, and drop all Linux capabilities.
Use a read-only root filesystem while still allowing the process to use /tmp.

Do not use environment variables for the Secret and do not use wildcard-like broad mounts of the Secret volume.

Verification

kubectl --context kind-cks-lab apply -f .\lab\lesson-10-fixture.yaml
kubectl --context kind-cks-lab apply -f .\lab\lesson-10-answer.yaml
kubectl --context kind-cks-lab -n billing wait --for=condition=Ready pod/reconciler --timeout=60s
kubectl --context kind-cks-lab -n billing exec reconciler -- id
kubectl --context kind-cks-lab -n billing exec reconciler -- cat /var/run/credentials/api-key
kubectl --context kind-cks-lab -n billing exec reconciler -- sh -c 'test ! -e /var/run/credentials/legacy-password && touch /tmp/proof'
kubectl --context kind-cks-lab -n billing exec reconciler -- sh -c 'test ! -e /var/run/secrets/kubernetes.io/serviceaccount/token'

Expected: a non-zero UID, test-key, and success from each final two commands.

Retrieval check

Question

Which Secret-volume mechanism prevents an unneeded key from being mounted at all?

Specify the allowed key under the volume’s items list.Set only readOnly: true on the volume mount.Set a restrictive file mode alone.

Documentation target

Use the Kubernetes Secret reference for selective key projection and the Security Context guide for the runtime controls.

What to send me

Paste your Pod YAML and the four proof results. I’ll inspect both the visible behavior and whether the manifest prevents the broader Secret exposure.