<p>Is it possible to configure k8s in a way that empty secrets are not possible?</p>
<p>I had a problem in a service that somewhat the secret got overwritten with an empty one (zero bytes) and thereby my service malfunctioned. I see no advantage of having an secret empty at any time and would like to prevent empty secrets all together.</p>
<p>Thans for your help!</p>

Simon Frey
<p>While it's not a simple answer to implement, as best I can tell what you are looking for is an <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">Admission Controller</a>, with a very popular one being <a href="https://open-policy-agent.github.io/gatekeeper/website/docs/" rel="nofollow noreferrer">OPA Gatekeeper</a></p>
<p>The theory is that kubernetes, as a platform, does not understand your business requirement to keep mistakes from overwriting Secrets. But OPA as a policy rules engine allows you to specify those things without requiring the upstream kubernetes to adopt those policies for everyone</p>
<p>An alternative is to <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">turn on audit logging</a> and track down the responsible party for re-education</p>
<p>A further alternative is to correctly scope RBAC Roles to actually deny writes to Secrets except for those credentials that are known to be trusted</p>
