Implement a k8s secret gatherer about jetstack-secure HOT 4 CLOSED

There isn't a way that I'm aware of to do this listing for just metadata. There are references to PartialObjectMetadata in the Kubernetes code-base, but this is only utilised client-side from what I can see (specifically, as part of the garbage collector in kube-controller-manager which handles things like owner references).

In lieu of this, I think we'll need to just gather the full resource for now. You may want to ask over in #sig-api-machinery on slack.k8s.io to see if anyone has any more tips here, as I know there was some support for alternative output formats added to the apiserver a while ago (although I'm not sure how flexible this is).

from jetstack-secure.

I'm having a look into this now. The ideal solution would be if we can find a way to just List Secret metadata.

If that isn't possible we may have to fetch the Secret and have the data gatherer redact the data part. For users running the agent in cluster (which we expect will be most of them) this isn't too bad.

We should probably also have Preflight output a warning if it sees Secrets being gathered, both in the agent and any package development tools.

from jetstack-secure.

The response from #sig-api-machinery indicates we can't just fetch metadata so I'm going to work on the solution I described above where we fetch the full resource but remove the data and log a warning.

from jetstack-secure.

There is an open pull request that needs to be reviewed.

from jetstack-secure.