Skip to content

K
k3s
Commit 6a9ba0cf authored by Daniel Smith's avatar Daniel Smith
Browse files
Options

Merge pull request #6687 from ddysher/fix-doc

Small fix for secret doc
parents 1a2e4f8e 6679b850
Show whitespace changes
Inline Side-by-side
Showing with 1 addition and 2 deletions
docs/secrets.md
View file @ 6a9ba0cf
...@@ -318,7 +318,7 @@ Pod level](#use-case-two-containers). ...@@ -318,7 +318,7 @@ Pod level](#use-case-two-containers).
### Risks ### Risks
- Applications still need to protect the value of secret after reading it from the volume, - Applications still need to protect the value of secret after reading it from the volume,
such not accidentally logging it or transmitting it to an untrusted party. such as not accidentally logging it or transmitting it to an untrusted party.
- A user who can create a pod that uses a secret can also see the value of that secret. Even - A user who can create a pod that uses a secret can also see the value of that secret. Even
if apiserver policy does not allow that user to read the secret object, the user could if apiserver policy does not allow that user to read the secret object, the user could
run a pod which exposes the secret. run a pod which exposes the secret.
...@@ -330,4 +330,3 @@ Pod level](#use-case-two-containers). ...@@ -330,4 +330,3 @@ Pod level](#use-case-two-containers).
by impersonating the kubelet. It is a planned feature to only send secrets to by impersonating the kubelet. It is a planned feature to only send secrets to
nodes that actually require them, to restrict the impact of a root exploit on a nodes that actually require them, to restrict the impact of a root exploit on a
single node. single node.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment