documentation_complete: true


title: 'Do Not Use Environment Variables with Secrets'

description: |-
    Secrets should be mounted as data volumes instead of environment
    variables.

rationale: |-
    Environment variables are subject and very susceptible to
    malicious hijacking methods by an adversary, as such,
    environment variables should never be used for secrets.

severity: medium

references:
    cis@ocp4: 5.4.1
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'secrets mounted as environment variables need review'

ocil: |-
    To find workloads that use environment variables for secrets, run the following:
    <pre>$ oc get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.namespace} {.metadata.name} {"\n"}{end}' -A</pre>
    Review the output and ensure that workloads that can mount secrets as data
    volumes use that instead of environment variables.
