<p>AFAIK administrators can use exec to execute commands in a container running in kubernetes. This means that they can see all the secrets correct?</p>

<p>Now if the secret is used to connect to something externally, which that administrator does not have access to, how can I avoid that the adminstrator gets access to that external system?</p>

<p>Do I need to use something like Hashicorps Vault? </p>

<blockquote>
  <p>Do I need to use something like Hashicorps Vault? </p>
</blockquote>

<p>Generally, yes: you need an external encrypted source in order to separate secret management (readable by admins with the right RBAC) and secrets.</p>

<p>For instance, something like <a href="https://github.com/hashicorp/vault-plugin-auth-kubernetes" rel="nofollow noreferrer"><code>hashicorp/vault-plugin-auth-kubernetes</code></a> can help and allows for Kubernetes Service Accounts to authenticate with Vault.</p>
