Kubernetes Security Technical Implementation Guide

The Kubernetes Security Technical Implementation Guide (V2 R6) has 92 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

92STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 01 2026

Kubernetes must limit Secret access on a need-to-know basis.

Kubernetes Security Technical Implementation Guide

Assessment Title

Rule Text

Kubernetes must limit Secret access on a need-to-know basis.

Description

Discussion Text

Kubernetes secrets may store sensitive information such as passwords, tokens, and keys. Access to these secrets should be limited to a need-to-know basis via Kubernetes RBAC.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-274884

Rule

SV-274884r1107245_rule

Severity

medium

Rule Version

CNTR-K8-001163

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the Kubernetes accounts and their corresponding roles. 

If any accounts have read (list, watch, get) access to Secrets without a documented organizational requirement, this is a finding. 

Run the below command to list the workload resources for applications deployed to Kubernetes:
kubectl get all -A -o yaml 

If Secrets are attached to applications without a documented requirement, this is a finding.

Implementation Procedure

Fix Text

For Kubernetes accounts that have read access to Secrets without a documented requirement, modify the corresponding Role or ClusterRole to remove list, watch, and get privileges for Secrets.

STIG check 92 of 92 in the Kubernetes STIG checklist

← Previous · V-274883Sensitive information must be stored using Kubernetes Secrets or an external Secret store provider.