A Kubernetes Secret is base64-encoded, not encrypted, and by default the API server stores it unencrypted in etcd. Every copy of a credential, in an image layer, a log line or an environment dump, is one more place to leak from and one more place a rotation has to reach.
- Keep credentials in Kubernetes Secrets or an external secret store, never in images, ConfigMaps or source code, and mount them as files rather than environment variables.
- Encrypt Secrets at rest in etcd with a KMS provider, and restrict
get,listandwatchon Secrets with RBAC. - Replace static cloud credentials with workload identity federation, and use short-lived service account tokens from the TokenRequest API.
- Automate rotation, and check that each rotation reaches the running process.
Guides on this site
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Workload identity federation: short-lived, scoped identities for services and CI
Trace how a running workload obtains a short-lived identity, write cloud trust policies that match immutable claims instead of names or wildcards, and keep the resulting credential limited by audience and authorization.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Practice
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
- Gate an image build on a CIS scan and a deviation register · Local project
References
- K03:2025 Secrets Management Failures (OWASP)
- Kubernetes documentation: Good practices for Kubernetes Secrets
- Kubernetes documentation: Encrypting Confidential Data at Rest
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.