Skip to content

Commit a909bd7

Browse files
authored
Merge pull request #28805 from YuvalAvra/remove-secrets-node-risk
Remove an outdated risk regarding node permissions over secrets
2 parents 792093b + 3381399 commit a909bd7

File tree

1 file changed

+0
-4
lines changed
  • content/en/docs/concepts/configuration

1 file changed

+0
-4
lines changed

content/en/docs/concepts/configuration/secret.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1235,10 +1235,6 @@ for secret data, so that the secrets are not stored in the clear into {{< glossa
12351235
- A user who can create a Pod that uses a secret can also see the value of that secret. Even
12361236
if the API server policy does not allow that user to read the Secret, the user could
12371237
run a Pod which exposes the secret.
1238-
- Currently, anyone with root permission on any node can read _any_ secret from the API server,
1239-
by impersonating the kubelet. It is a planned feature to only send secrets to
1240-
nodes that actually require them, to restrict the impact of a root exploit on a
1241-
single node.
12421238

12431239

12441240
## {{% heading "whatsnext" %}}

0 commit comments

Comments
 (0)