Kubernetes Secrets and RBAC Hardening

I set out to assess whether Kubernetes Secrets were protected by RBAC, restrict access to only authorised service accounts, and validate that the controls worked.

A Minikube cluster ran an Nginx application with a Kubernetes Secret called terminal-creds containing a username and password. No RBAC restrictions were in place, so any service account in the namespace could query and decode the secret. I wanted to lock it down to a single authorised service account.

1. 01
   Enumerated the cluster

   I started the Minikube cluster, listed running pods, and deployed the Nginx application.

2. 02
   Retrieved the secret

   I queried terminal-creds and decoded the username and password, confirming unrestricted access.

3. 03
   Created service accounts

   I set up terminal-user (should be denied) and terminal-admin (should be allowed) service accounts.

4. 04
   Configured RBAC

   I created a Role granting get access to the terminal-creds secret and a RoleBinding that bound it only to terminal-admin.

5. 05
   Validated access controls

   I tested both service accounts with kubectl auth can-i.

# RoleBinding restricting secret access to terminal-admin
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: terminal-creds-binding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: terminal-admin
    namespace: default
roleRef:
  kind: Role
  name: terminal-creds-reader
  apiGroup: rbac.authorization.k8s.io

After applying the RBAC configuration, access was correctly restricted:

terminal-user can get secret/terminal-creds:   no
terminal-admin can get secret/terminal-creds:  yes

The terminal-user service account was denied access, while terminal-admin was authorised, confirming the RBAC controls were enforced.

1. 01Apply RBAC to every Kubernetes Secret so that only the service accounts that need them can read them.
2. 02Avoid relying on namespace isolation alone; use Roles and RoleBindings for fine-grained access.
3. 03Use encrypted secret storage (such as sealed secrets or an external secrets manager) rather than base64-encoded Kubernetes Secrets.
4. 04Audit RBAC configurations regularly and remove any overly broad bindings.
5. 05Use kubectl auth can-i to validate access controls after every change.