Consider External Secret Storage

# 1) List all namespaces
# Run on: any machine with kubectl access
kubectl get namespaces

# 2) For each relevant namespace, list all Secrets and how they are used
# Run on: any machine with kubectl access

NAMESPACE=default

# List secrets (type and age give quick hints)
kubectl get secrets -n "${NAMESPACE}" -o wide

# Show detailed info for each secret (excluding the value)
kubectl get secrets -n "${NAMESPACE}" -o yaml

# Show which workloads reference secrets via env / envFrom / volumes
kubectl get deploy,sts,ds,job,cronjob -n "${NAMESPACE}" -o yaml | \
  grep -nE 'secretKeyRef|secretRef|secretName' -A3 -B3

# 3) Identify secrets that look like external system credentials
# Run on: any machine with kubectl access

NAMESPACE=default

# Show secret names only, to focus the review
kubectl get secrets -n "${NAMESPACE}" -o custom-columns=NAME:.metadata.name,TYPE:.type

# For specific secrets that might be external creds, inspect metadata only
SECRET_NAME=my-db-credentials
kubectl get secret "${SECRET_NAME}" -n "${NAMESPACE}" -o yaml | \
  sed '/^data:/q'

# 4) Check for cluster‑wide patterns (where external manager would help most)
# Run on: any machine with kubectl access

# Count secrets by namespace
kubectl get secrets --all-namespaces \
  -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.type | \
  sort | uniq -c | sort -nr | head

# List all Opaque secrets across all namespaces (excluding well-known system ones)
kubectl get secrets --all-namespaces \
  -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.type | \
  grep -vE 'kube-system|kube-public|kube-node-lease' | \
  grep 'Opaque'

# 5) Check if an external secrets solution is already in use
# Run on: any machine with kubectl access

# Look for common CRDs used by external secret managers
kubectl get crds | grep -iE 'secret|vault|externalsecret|external-secrets|secrets-store'

# Look for known operators in all namespaces
kubectl get pods --all-namespaces | grep -iE 'secret|vault|external|secrets-store' || true

#!/usr/bin/env bash
#
# cis-eks-4.4.2-secrets-usage-report.sh
#
# Run on: any machine with kubectl access and correct context
#
# This script does NOT fix anything. It summarizes how secrets are used so you
# can decide whether external secret storage should be adopted or expanded.
#
# It focuses on:
#   - Count and age of native Kubernetes Secrets
#   - Which types are used (Opaque, kubernetes.io/dockerconfigjson, tls, etc.)
#   - Workloads that project secrets as env vars or volumes
#   - Namespaces with heavy secret use
#
# Interpretation guidance is at the end of this file.

set -euo pipefail

# Ensure kubectl works
if ! kubectl version --short >/dev/null 2>&1; then
  echo "ERROR: kubectl is not configured or cannot reach the cluster" >&2
  exit 1
fi

echo "=== [1] Cluster-wide summary of Kubernetes Secret objects ==="
kubectl get secrets --all-namespaces -o json \
  | jq -r '
    .items
    | ( "NAMESPACE,NAME,TYPE,CREATED,AGE_DAYS,DATA_KEYS" ),
      ( .[] |
        . as $s
        | .metadata.namespace as $ns
        | .metadata.name as $name
        | .type as $type
        | .metadata.creationTimestamp as $created
        | ( (now - ($created | fromdate)) / 86400 | floor ) as $age_days
        | ($s.data // {} | keys | join("|")) as $keys
        | [$ns, $name, $type, $created, ($age_days|tostring), $keys]
        | @csv
      )
  ' | column -s, -t

echo
echo "=== [2] Secret counts per namespace and type ==="
kubectl get secrets --all-namespaces -o json \
  | jq -r '
    .items
    | group_by(.metadata.namespace)[] as $nsGroup
    | ($nsGroup[0].metadata.namespace) as $ns
    | ($nsGroup
        | group_by(.type)[]
        | [ $ns,
            .[0].type,
            (length | tostring)
          ] | @tsv
      )
  ' | awk 'BEGIN { printf "%-30s %-40s %s\n", "NAMESPACE", "TYPE", "COUNT" }
           { printf "%-30s %-40s %s\n", $1, $2, $3 }'

echo
echo "=== [3] Top namespaces by number of Secret objects ==="
kubectl get secrets --all-namespaces \
  | awk 'NR>1 {count[$1]++} END { for (ns in count) print count[ns], ns }' \
  | sort -nr \
  | head -20 \
  | awk 'BEGIN { printf "%-30s %s\n", "NAMESPACE", "SECRET_COUNT" }
               { printf "%-30s %s\n", $2, $1 }'

echo
echo "=== [4] Workloads using Secrets as environment variables ==="
echo "--- Deployments ---"
kubectl get deploy --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $name
    | (.spec.template.spec.containers // [])[]? as $c
    | ($c.env // [])[]? as $e
    | select($e.valueFrom.secretKeyRef != null)
    | [ $ns,
        $name,
        $c.name,
        $e.name,
        $e.valueFrom.secretKeyRef.name,
        $e.valueFrom.secretKeyRef.key
      ] | @tsv
  ' 2>/dev/null \
  | awk 'BEGIN { printf "%-30s %-40s %-30s %-25s %-40s %s\n", "NAMESPACE", "DEPLOYMENT", "CONTAINER", "ENV_VAR", "SECRET_NAME", "SECRET_KEY" }
               { printf "%-30s %-40s %-30s %-25s %-40s %s\n", $1, $2, $3, $4, $5, $6 }'

echo
echo "--- StatefulSets ---"
kubectl get statefulset --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $name
    | (.spec.template.spec.containers // [])[]? as $c
    | ($c.env // [])[]? as $e
    | select($e.valueFrom.secretKeyRef != null)
    | [ $ns,
        $name,
        $c.name,
        $e.name,
        $e.valueFrom.secretKeyRef.name,
        $e.valueFrom.secretKeyRef.key
      ] | @tsv
  ' 2>/dev/null \
  | awk 'BEGIN { printf "%-30s %-40s %-30s %-25s %-40s %s\n", "NAMESPACE", "STATEFULSET", "CONTAINER", "ENV_VAR", "SECRET_NAME", "SECRET_KEY" }
               { printf "%-30s %-40s %-30s %-25s %-40s %s\n", $1, $2, $3, $4, $5, $6 }'

echo
echo "--- DaemonSets ---"
kubectl get daemonset --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $name
    | (.spec.template.spec.containers // [])[]? as $c
    | ($c.env // [])[]? as $e
    | select($e.valueFrom.secretKeyRef != null)
    | [ $ns,
        $name,
        $c.name,
        $e.name,
        $e.valueFrom.secretKeyRef.name,
        $e.valueFrom.secretKeyRef.key
      ] | @tsv
  ' 2>/dev/null \
  | awk 'BEGIN { printf "%-30s %-40s %-30s %-25s %-40s %s\n", "NAMESPACE", "DAEMONSET", "CONTAINER", "ENV_VAR", "SECRET_NAME", "SECRET_KEY" }
               { printf "%-30s %-40s %-30s %-25s %-40s %s\n", $1, $2, $3, $4, $5, $6 }'

echo
echo "=== [5] Workloads mounting Secrets as volumes ==="
for kind in deployment statefulset daemonset; do
  kind_uc=$(echo "$kind" | tr '[:lower:]' '[:upper:]')
  echo "--- ${kind_uc}s ---"
  kubectl get "$kind" --all-namespaces -o json \
    | jq -r '
      .items[]
      | .metadata.namespace as $ns
      | .metadata.name as $name
      | (.spec.template.spec.volumes // [])[]
      | select(.secret != null)
      | [ $ns,
          $name,
          .name,
          .secret.secretName
        ] | @tsv
    ' 2>/dev/null \
    | awk -v KIND="$kind_uc" 'BEGIN { printf "%-30s %-40s %-30s %s\n", "NAMESPACE", KIND, "VOLUME_NAME", "SECRET_NAME" }
                              { printf "%-30s %-40s %-30s %s\n", $1, $2, $3, $4 }'
  echo
done

echo "=== [6] Pods directly referencing Secrets (non-controller-managed) ==="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(.metadata.ownerReferences == null or (.metadata.ownerReferences | length == 0))
    | .metadata.namespace as $ns
    | .metadata.name as $name
    | (
        [(.spec.volumes // [])[]? | select(.secret != null) | ["volume", .name, .secret.secretName]],
        [(.spec.containers // [])[]? as $c
          | ($c.env // [])[]?
          | select(.valueFrom.secretKeyRef != null)
          | ["env", $c.name, .valueFrom.secretKeyRef.name]
        ]
      )[]
    | [ $ns, $name, .[0], .[1], .[2] ] | @tsv
  ' 2>/dev/null \
  | awk 'BEGIN { printf "%-30s %-40s %-10s %-30s %s\n", "NAMESPACE", "POD", "REF_TYPE", "CONTAINER/VOLUME", "SECRET_NAME" }
               { printf "%-30s %-40s %-10s %-30s %s\n", $1, $2, $3, $4, $5 }'

echo
echo "================================================================================"
echo "INTERPRETING THIS OUTPUT (WHAT MAY INDICATE A PROBLEM)"
echo
cat <<'EOF'
This control is MANUAL: there is no one correct target state. Use the data above to
decide if you should adopt or expand an external secrets manager (cloud-native or
third-party):

Signs you may want to move more to external secret storage:
- [1]/[2]/[3]: Large numbers of Opaque secrets, especially:
  - With very old AGE_DAYS (stale or long-lived credentials).
  - In many different namespaces without consistent naming or ownership.
- [4]: Applications using many env vars from secrets:
  - Env vars are easily exposed via "kubectl describe pod" and logs.
  - Consider replacing sensitive values with references to an external
    secrets manager via a sidecar, CSI driver, or operator.
- [5]/[6]: Workloads mounting large or generic secrets (e.g. "app-config", "credentials")
  that likely mix different secret values instead of using a dedicated external store.

This script only reports usage. To remediate, you must:
- Select and configure a cloud provider or third-party secrets manager.
- Redesign workloads to fetch or project secrets from that system.
EOF