documentation_complete: true


title: 'Consider external secret storage'

description: |-
    Consider the use of an external secrets storage and management system,
    instead of using Kubernetes Secrets directly, if you have more complex
    secret management needs. Ensure the solution requires authentication to
    access secrets, has auditing of access to and use of secrets, and encrypts
    secrets. Some solutions also make it easier to rotate secrets.

rationale: |-
    Kubernetes supports secrets as first-class objects, but care needs to be
    taken to ensure that access to secrets is carefully limited. Using an
    external secrets provider can ease the management of access to secrets,
    especially where secrets are used across both Kubernetes and non-Kubernetes
    environments.

severity: medium

references:
    cis@ocp4: 5.4.2
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'review the need for external secrets storage'

ocil: |-
    Review the cluster configuration and determine if an appropriate secrets
    manager has been configured.
