<p>I'd like to know if <code>kubectl</code> offers an easy way to list all the secrets that a certain pod/deployment/statefulset is using, or if there is some way to cleanly retrieve this info. When doing a <code>kubectl describe</code> for a pod, I see I can get a list of mounted volumes which include the ones that come from secrets that I could extract using <code>jq</code> and the like, but this way feels a bit clumsy. I have been searching a bit to no avail. Do you know if there is anything like that around? Perhaps using the API directly?</p>

<p>To <a href="https://kubernetes.io/docs/reference/kubectl/cheatsheet/" rel="nofollow noreferrer">List all Secrets</a> currently in use by a pod use:</p>
<pre><code>kubectl get pods -o json | jq '.items[].spec.containers[].env[]?.valueFrom.secretKeyRef.name' | grep -v null | sort | uniq
</code></pre>
<p>In the other hand if you want to access to stored secrets in the API:</p>
<blockquote>
<p>Kubernetes Secrets are, by default, stored unencrypted in the API
server's underlying data store (etcd). Anyone with API access can
retrieve or modify a Secret, and so can anyone with access to etcd.
Additionally, anyone who is authorized to create a Pod in a namespace
can use that in order to safely use Secrets, take at least the
following steps:</p>
<ul>
<li>Enable Encryption at Rest for Secrets.</li>
<li>Enable or configure RBAC rules that restrict reading data in Secrets    (including via indirect means).</li>
<li>Where appropriate, also use mechanisms such as RBAC to limit which    principals are allowed to create new Secrets or replace existing<br />
ones.access to read any Secret in that namespace; this includes<br />
indirect access such as the ability to create a Deployment.</li>
</ul>
</blockquote>
<p>If you want more information about secrets in kubernetes, <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">follow this link.</a></p>
