Secrets Should Be Encrypted At Rest

#!/usr/bin/env bash
#
# Check: Secrets are encrypted at rest (CBP C6.2) - MANUAL
#
# This script does NOT prove that KMS/envelope encryption is enabled,
# because that setting lives in the managed control plane / cloud
# provider config and is not exposed via the Kubernetes API.
#
# Instead, it:
#   1. Lists all namespaces and counts Secrets (to scope review effort).
#   2. Fetches one sample Secret per namespace and shows encoded size.
#   3. Prints guidance on what must be reviewed manually in the cloud console / IaC.
#
# Run from: any machine with kubectl access and cluster-wide read on Secrets.

set -euo pipefail

echo "==[ Context ]===================================================="
kubectl config current-context || true
echo

echo "==[ Namespaces and Secret counts ]==============================="
kubectl get ns -o custom-columns='NAMESPACE:.metadata.name' --no-headers | while read -r ns; do
  count=$(kubectl get secrets -n "$ns" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  printf "%-30s %6s\n" "$ns" "$count"
done
echo

echo "==[ Sample Secret sizes by namespace ]==========================="
echo "# For each namespace (that has Secrets), one arbitrary Secret is inspected."
echo "# This does NOT show whether etcd encryption is enabled; it just helps identify"
echo "# where sensitive data is stored for focused review."
echo

kubectl get ns -o custom-columns='NAMESPACE:.metadata.name' --no-headers | while read -r ns; do
  secret_name=$(kubectl get secrets -n "$ns" --no-headers 2>/dev/null | awk 'NR==1{print $1}')
  if [ -z "${secret_name:-}" ]; then
    continue
  fi

  echo "Namespace: $ns"
  echo "  Sample Secret: $secret_name"
  # Dump Secret yaml to show type and keys (but not decoded values)
  kubectl get secret "$secret_name" -n "$ns" -o yaml | sed 's/^/    /'
  echo

  # Show the approximate size of the raw Secret object and each data entry
  echo "  Encoded data entry sizes (bytes):"
  kubectl get secret "$secret_name" -n "$ns" -o json \
    | jq -r '
      .data // {} | to_entries[]
      | "    \(.key): \(.value | @base64d | length)"
    '
  echo "------------------------------------------------------------"
done

echo
echo "==[ Manual review required ]======================================"
cat <<'EOF'
This benchmark control is MANUAL: there is no kubectl/API field that
shows whether KMS/envelope encryption for Secrets is enabled.

Use this script's output to:
  - Identify namespaces and Secrets that contain sensitive data.
  - Prioritize which environments/clusters must have KMS/envelope encryption enabled.

Then, for EACH CLUSTER, verify in the cloud provider:

*Amazon EKS*
  - Console: EKS > Clusters > <cluster> > Configuration > Encryption
    - EXPECTED: "Secrets encryption" (or similar) enabled with a KMS key.
  - CLI (example, read-only):
      aws eks describe-cluster --name <cluster-name> \
        --region <region> \
        --query 'cluster.encryptionConfig' --output yaml
    - EXPECTED: encryptionConfig contains:
        - resources including "secrets"
        - provider.keyArn set to a KMS key ARN

*Google GKE*
  - Console: Kubernetes Engine > Clusters > <cluster> > Details > Security
    - EXPECTED: "Application-layer Secrets Encryption" enabled for secrets.
  - CLI (example, read-only):
      gcloud container clusters describe <cluster-name> \
        --region <region> \
        --format='yaml(databaseEncryption,workloadIdentityConfig)'
    - EXPECTED: databaseEncryption.state: "ENCRYPTED"
      and keyName set to a KMS key.

*Azure AKS*
  - Console: Kubernetes services > <cluster> > Encryption
    - EXPECTED: "Secret encryption with customer-managed keys" enabled.
  - CLI (example, read-only):
      az aks show -g <resource-group> -n <cluster-name> \
        --query 'securityProfile.azureKeyVaultKms' -o yaml
    - EXPECTED: "enabled": true and a configured Key Vault/Key ID.

*Other managed / on-prem*
  - Review the control plane configuration (API server / etcd config or
    cluster definition in IaC) for:
      - EncryptionConfiguration with a KMS provider that lists "secrets"
        in the resources array, OR
      - The provider's documented "Secrets envelope/KMS encryption" option.

What indicates a PROBLEM (non-compliant state):
  - No documentation or IaC showing KMS/envelope encryption enabled.
  - Cloud console / CLI shows:
      - No encryptionConfig, or
      - encryptionConfig without "secrets" as a resource, or
      - Provider-specific flag for Secrets encryption is disabled/not set.
In these cases, Secrets are likely stored in plaintext in etcd and this
control should be marked as failing until KMS/envelope encryption is
explicitly enabled.
EOF