<p>I want to rename my k8s <code>Secrets</code> and want to check if there are unused <code>Secrets</code>. Also I would like to know how many and which <code>containers</code> reference a <code>Secret</code>.</p>

<p>Is there a easier way to do this than search for the secret names in all deployments?</p>

<p>Thanks Simon. Based on your answer I created a diff, which shows <code>secrets</code> that are not referenced in the containers env section. <code>Secrets</code> can also be referenced in:</p>
<ul>
<li><code>TLS</code> section of Ingresses</li>
<li><code>Pods</code> <code>Volumes</code> spec, like Simon mentioned</li>
<li><code>ImagePullSecrets</code> for private repositories</li>
<li><code>CRDs</code> Custom Resource Definitions</li>
</ul>
<p>But for me it is enough to find <code>secrets</code> that are not referenced in environment variables:</p>
<pre><code>diff \
&lt;(kubectl get pods -o jsonpath='{.items[*].spec.containers[*].env[*].valueFrom.secretKeyRef.name}' | xargs -n1 | sort | uniq) \
&lt;(kubectl get secrets -o jsonpath='{.items[*].metadata.name}' | xargs -n1 | sort | uniq)
</code></pre>
<p><strong>Update 16.04.2018</strong></p>
<p>I created a more advanced version to find also secrets referenced in <code>volumes</code>, <code>ingress tls</code> and <code>imagePullSecrets</code>. The following snippet will show you all unused <code>secrets</code> for the current namespace.</p>
<p><strong>Caution:</strong> The script does not cover all options where secrets can be referenced (e.g. Custom Resource Definitions).</p>
<p><strong>Update 15.06.2021</strong>: Added secrets from Pod container spec <code>envFrom[*].secretRef.name</code> as secret source</p>
<pre><code>envSecrets=$(kubectl get pods -o jsonpath='{.items[*].spec.containers[*].env[*].valueFrom.secretKeyRef.name}' | xargs -n1)
envSecrets2=$(kubectl get pods -o jsonpath='{.items[*].spec.containers[*].envFrom[*].secretRef.name}' | xargs -n1)
volumeSecrets=$(kubectl get pods -o jsonpath='{.items[*].spec.volumes[*].secret.secretName}' | xargs -n1)
pullSecrets=$(kubectl get pods -o jsonpath='{.items[*].spec.imagePullSecrets[*].name}' | xargs -n1)
tlsSecrets=$(kubectl get ingress -o jsonpath='{.items[*].spec.tls[*].secretName}' | xargs -n1)

diff \
&lt;(echo &quot;$envSecrets\n$envSecrets2\n$volumeSecrets\n$pullSecrets\n$tlsSecrets&quot; | sort | uniq) \
&lt;(kubectl get secrets -o jsonpath='{.items[*].metadata.name}' | xargs -n1 | sort | uniq)
</code></pre>
