2

I am trying to mount a secret in the pod securely. I have created the secrets with defaultMode: 0400 and runAsUser:1000. However when i am trying to access the secret in the container after doing exec in it, the secret file is owned by root. So the user with UID:1000 is not able to access it.

Pod.yaml

apiVersion: v1
kind: Pod
spec:
containers:
- image: busybox
  command: ["sleep","5000"]
  securityContext:
    runAsUser: 1000
  volumeMounts:
  - name: secret-volume
    mountPath: /opt/secretdir
    readOnly: true
volumes:
- name: secret-volume
    secret:
      secretName: mysecret
      defaultMode: 0400

Output of ls -l

-r-------- 1 root root 8 Jul 5 14:05 mysec

Why is the file created with root ownership? What is the secured way to mount secrets in the pod? Please provide an example manifest if possible.

1 Answer 1

2

So it turns out that this is a long standing issue in Kubernetes (GitHub Issue here). Whilst you can change the user of service account token secrets by setting RunAsUser at the Pod level (reference here), you can't set the owner of a general secret.

The workaround, is to set the permissions of the secret to be one that all users in the container can read. As, generally, there's only one active user in a container, this often won't be a serious security issue. To do this you set the defaultMode in the Volume definition to be something like 0666.

5
  • Tried adding the SecurityContext to Pod level, still facing the same issue. Commented Aug 22, 2023 at 11:42
  • @warrior-oo7 do you have a copy of the updated pod manifest you're applying? Commented Aug 23, 2023 at 10:23
  • here is the link to the updated yaml codebeautify.org/yaml-validator/y2379c208 Commented Aug 29, 2023 at 18:26
  • 1
    @warrior-oo7 thanks! I took more of a look into this, and updated the answer with what I've found :) Commented Sep 1, 2023 at 11:04
  • I found this, I preferred to set 0444 on the volume containing the mounted secret. I expect it makes little practical difference [I didn't attempt to write the file] but it indicates the usage expectation of the certificate file. Commented Jun 4 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .