Cloud › Module 7 › Lesson 3
Secrets Hygiene
Secrets hygiene literacy — Kubernetes Secret vs external vault category, no plaintext in manifests, rotation stub — on `$CLOUD_LAB` only.
Visual · t31_secrets_hygiene
Secrets hygiene = named credential rows. $CLOUD_LAB. Original Cyberlium.
Opening
Secrets in Git and env vars become breaches — name K8s secret hygiene on YOUR lab manifests before copying prod credentials into kind.
Secrets hygiene literacy names: never commit plaintext secrets category, Kubernetes Secret vs external secrets operator/vault category, base64-is-not-encryption note, RBAC restrict secrets get/list (Module 7-1 link), rotation cadence stub, and sealed-secrets/ESO literacy category. Analyst audits `$CLOUD_LAB` kind lab manifests for secret leakage — documents remediation rows (move to Secret object, restrict RBAC, rotation ticket stub) — without pasting prod credentials, without exfiltrating stranger cluster secrets, without publishing real API keys in repo. Cyberlium teaches defender credential hygiene — NOT credential harvesting. Refused: prod secret paste, stranger etcd access, committing live keys to git. Lab row: secrets hygiene audit table (finding, risk, fix category, UTC) with three rows on lab manifests.
1. Named hygiene rules
No plaintext in Git, Secret vs vault, RBAC restrict, rotation, sealed/ESO — five literacy anchors.
base64 encoding ≠ encryption — literacy note on lab Secret object.
Command guide
Try these commands — Named hygiene rules
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: K8s secrets (https://kubernetes.io/docs/concepts/configuration/secret/); External Secrets (https://kubernetes.io/docs/concepts/configuration/secret/#external-secrets); Sealed Secrets / ESO docs (https://external-secrets.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Manifest audit
Scan lab YAML for env literals, ConfigMap secrets, and overly broad RBAC.
Fix category documents move-to-Secret and restrict-binding rows.
3. Refused
No prod credential paste; no stranger cluster secret exfiltration.
Secrets hygiene supports cloud defense — not credential theft.
4. What you ship: secrets hygiene audit table
Three audit rows + fix category each + NEVER prod credential paste line.
5. What you record before the next lesson
Secrets hygiene audit table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy employer prod database password into kind manifest as 'realistic lab.'
Right
Secrets hygiene audit from `$CLOUD_LAB` lab manifests. Next: K8s Lab.
Mission: secrets hygiene audit table
1) Name five secrets hygiene rules. 2) Three audit rows on lab manifests. 3) Fix category per row. 4) Write NEVER prod credential paste line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ESO vs Sealed Secrets — literacy stub?”
Knowledge Check
APPLY: Secrets hygiene literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Pasting prod passwords into lab manifests is OK.
True or False
Knowledge Check
APPLY: base64 in Secret object:
Multiple choice