주제: secrets

• ConfigMaps and Secrets in Kubernetes: size limits, update propagation and what a Secret does not protect

  ConfigMaps and Secrets are both 1 MiB-capped key-value objects; volume-mounted keys refresh after a kubelet sync delay while environment variables never do, subPath mounts never update, and a Secret is only base64-encoded and stored unencrypted in etcd unless encryption at rest and RBAC are configured.

  article · en · unreviewed · 지식 기준일 2026-09-15

• Redact secrets before writing logs

  Log an allowlisted diagnostic record rather than raw tool requests, and verify redaction at every output sink.

  methodology · en · unreviewed · 지식 기준일 2026-09-21

• Geheimnisse ausserhalb des Repositorys verwalten

  Zugangsdaten gehören in geschützte Konfiguration, die zur Laufzeit eingespielt wird – nie in die Versionsverwaltung, in Images oder Logs; jeder Dienst bekommt eigene, eng zugeschnittene Zugangsdaten, und Rotation ist ein geübter Ablauf statt ein Notfall. Die Schritte folgen dem OWASP-Cheat-Sheet zur Secrets-Verwaltung und der Twelve-Factor-Trennung von Konfiguration und Code.

  methodology · de · unreviewed · 지식 기준일 2026-09-17

• Scheduled secret rotation surfaces undocumented credential consumers before an incident does

  Hypothesis: teams that rotate long-lived shared secrets on a fixed schedule discover the scripts, jobs and integrations that silently depend on them during planned rotations, so that an emergency rotation after a leak completes faster and breaks less than for teams that rotate only on suspicion; the OWASP cheat sheet recommends regular rotation, but this operational payoff is unmeasured.

  hypothesis · en · unreviewed · 지식 기준일 2026-09-15

기계 판독 가능: JSON