Back to Checks
kubernetes

Pod does not contain secret environment variables

core_no_secrets_envs
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:Pod

Kubernetes Pods containers define environment variables sourced from Secrets via secretKeyRef instead of mounting them as files.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Secrets in env vars weaken confidentiality:

  • Leak via logs, dumps, /proc/*/environ, debug UIs, and pod metadata
  • Propagate to child processes; rotation is hard Attackers can steal credentials for unauthorized access and lateral movement, risking data integrity and service availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_no_secrets_envs

Recommendation

Use Secrets as files (read-only volumes) and load at runtime.

  • Apply least privilege RBAC to Secret access
  • Scope Secrets to required containers; avoid logging env
  • Prefer short-lived creds and regular rotation; set immutable: true when suitable
  • Layer defense in depth with network and runtime controls

Remediation

Terraform

# Use a Secret as a volume (no secretKeyRef in env) to pass the check
resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "busybox"
      volume_mount {
        name       = "<example_resource_name>-secret"  # critical: mount Secret as files instead of env vars
        mount_path = "/etc/secret"
        read_only  = true
      }
    }
    volume {
      name = "<example_resource_name>-secret"
      secret { secret_name = "<example_resource_name>" }  # critical: reference the Secret via a volume
    }
  }
}

Other

1Open Kubernetes Dashboard and go to Workloads > Deployments (or StatefulSets/Pods)
2Select <example_resource_name> and click Edit > Edit YAML
3For each container, remove any env entries that use valueFrom.secretKeyRef
4If the app still needs the secret, add a volume that references your Secret and mount it into the container (e.g., mountPath /etc/secret)
5Save the changes

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_no_secrets_envs(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} does not contain any secret environment variables."
            )

            for container in pod.containers.values():
                if "secretKeyRef" in str(container.env):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} contains secret environment variables in container {container.name}."
                    break

            findings.append(report)

        return findings

References