Cloud › Module 7 › Lesson 3
Secrets Hygiene
Secrets hygiene literacy — Kubernetes Secret vs external vault category, no plaintext in manifests, rotation stub — on `$CLOUD_LAB` only.
Visual · t31_secrets_hygiene
Secrets hygiene = named credential rows. $CLOUD_LAB. Original Cyberlium.
Opening
Secrets in Git and env vars become breaches — name K8s secret hygiene on YOUR lab manifests before copying prod credentials into kind.
Secrets hygiene literacy names: never commit plaintext secrets category, Kubernetes Secret vs external secrets operator/vault category, base64-is-not-encryption note, RBAC restrict secrets get/list (Module 7-1 link), rotation cadence stub, and sealed-secrets/ESO literacy category. Analyst audits `$CLOUD_LAB` kind lab manifests for secret leakage — documents remediation rows (move to Secret object, restrict RBAC, rotation ticket stub) — without pasting prod credentials, without exfiltrating stranger cluster secrets, without publishing real API keys in repo. Cyberlium teaches defender credential hygiene — NOT credential harvesting. Refused: prod secret paste, stranger etcd access, committing live keys to git. Lab row: secrets hygiene audit table (finding, risk, fix category, UTC) with three rows on lab manifests.
1. Named hygiene rules
No plaintext in Git, Secret vs vault, RBAC restrict, rotation, sealed/ESO — five literacy anchors.
base64 encoding ≠ encryption — literacy note on lab Secret object.
Command guide
Try these commands — Named hygiene rules
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
K8s secrets — https://kubernetes.io/docs/concepts/configuration/secret/ External Secrets — https://kubernetes.io/docs/concepts/configuration/secret/#external-secrets (pattern literacy) Sealed Secrets / ESO docs — https://external-secrets.io/ (literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/k8s/secrets-hygiene-checklist.md" <<'EOF'
# K8s Secrets Hygiene — YOUR cluster
- [ ] Never commit secrets to git (use Sealed Secrets/ESO/Vault pattern)
- [ ] RBAC: restrict Secret get/list to needed ServiceAccounts
- [ ] Enable encryption at rest for etcd secrets
- [ ] Rotate credentials; short-lived tokens preferred
- [ ] No secrets in container ENV for prod — use mounted volumes
- [ ] Audit Secret access via audit logs
Lab: yaml stubs only — no exfil from stranger clusters
EOFCommand — copy this
grep '\[ \]' "$CLOUD_LAB/k8s/secrets-hygiene-checklist.md" curl -sS https://kubernetes.io/docs/concepts/configuration/secret/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: K8s secrets (https://kubernetes.io/docs/concepts/configuration/secret/); External Secrets (https://kubernetes.io/docs/concepts/configuration/secret/#external-secrets); Sealed Secrets / ESO docs (https://external-secrets.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Manifest audit
Scan lab YAML for env literals, ConfigMap secrets, and overly broad RBAC.
Fix category documents move-to-Secret and restrict-binding rows.
3. Refused
No prod credential paste; no stranger cluster secret exfiltration.
Secrets hygiene supports cloud defense — not credential theft.
4. What you ship: secrets hygiene audit table
Three audit rows + fix category each + NEVER prod credential paste line.
5. What you record before the next lesson
Secrets hygiene audit table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy employer prod database password into kind manifest as 'realistic lab.'
Right
Secrets hygiene audit from `$CLOUD_LAB` lab manifests. Next: K8s Lab.
Mission: secrets hygiene audit table
1) Name five secrets hygiene rules. 2) Three audit rows on lab manifests. 3) Fix category per row. 4) Write NEVER prod credential paste line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ESO vs Sealed Secrets — literacy stub?”
Knowledge Check
APPLY: Secrets hygiene literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Pasting prod passwords into lab manifests is OK.
True or False
Knowledge Check
APPLY: base64 in Secret object:
Multiple choice