Secrets Hygiene

Secrets hygiene literacy — Kubernetes Secret vs external vault category, no plaintext in manifests, rotation stub — on `$CLOUD_LAB` only.

Secrets Hygiene• Audio Walkthrough

00:00/03:16

Visual · t31_secrets_hygiene

Secrets hygiene = named credential rows. $CLOUD_LAB. Original Cyberlium.

Secrets in Git and env vars become breaches — name K8s secret hygiene on YOUR lab manifests before copying prod credentials into kind.

Secrets hygiene literacy names: never commit plaintext secrets category, Kubernetes Secret vs external secrets operator/vault category, base64-is-not-encryption note, RBAC restrict secrets get/list (Module 7-1 link), rotation cadence stub, and sealed-secrets/ESO literacy category. Analyst audits `$CLOUD_LAB` kind lab manifests for secret leakage — documents remediation rows (move to Secret object, restrict RBAC, rotation ticket stub) — without pasting prod credentials, without exfiltrating stranger cluster secrets, without publishing real API keys in repo. Cyberlium teaches defender credential hygiene — NOT credential harvesting. Refused: prod secret paste, stranger etcd access, committing live keys to git. Lab row: secrets hygiene audit table (finding, risk, fix category, UTC) with three rows on lab manifests.

1. Named hygiene rules

No plaintext in Git, Secret vs vault, RBAC restrict, rotation, sealed/ESO — five literacy anchors.

base64 encoding ≠ encryption — literacy note on lab Secret object.

Command guide

Try these commands — Named hygiene rules

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: K8s secrets (https://kubernetes.io/docs/concepts/configuration/secret/); External Secrets (https://kubernetes.io/docs/concepts/configuration/secret/#external-secrets); Sealed Secrets / ESO docs (https://external-secrets.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Manifest audit

Scan lab YAML for env literals, ConfigMap secrets, and overly broad RBAC.

Fix category documents move-to-Secret and restrict-binding rows.

3. Refused

No prod credential paste; no stranger cluster secret exfiltration.

Secrets hygiene supports cloud defense — not credential theft.

4. What you ship: secrets hygiene audit table

Three audit rows + fix category each + NEVER prod credential paste line.

5. What you record before the next lesson

Secrets hygiene audit table path.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Copy employer prod database password into kind manifest as 'realistic lab.'
Right: Secrets hygiene audit from `$CLOUD_LAB` lab manifests. Next: K8s Lab.

Hands-on Exercise