<p>I am looking for a kubectl command that will list everywhere a secret is referenced.</p>
<p>Example output:</p>
<pre><code>deploymentABC - secretkeyname1
deploymentXYZ - secretkeyname2
statefulset123 - secretkeyname1
</code></pre>
<p>I imagine it could access the <code>env.from.secret.name</code> from the yaml?</p>

tooptoop4
<p>For all this complicated queries and if you absolutely want to/only can use <code>kubectl</code>, you can rely on <a href="https://pkg.go.dev/text/template" rel="nofollow noreferrer">Go templates</a> support.</p>
<p>First, define the template (e.g. in a file <code>list_secrets.tmpl</code>).</p>
<pre><code>{{- range .items}}
    {{- $namespaceAndName := (printf &quot;%s\t%s/%s&quot; .kind .metadata.namespace .metadata.name)}}
    {{- range .spec.template.spec.containers}}
        {{- range .envFrom}}
            {{- $namespaceAndName}}{{- &quot; - &quot;}}{{- .secretRef.name}}{{- &quot;\n&quot;}}
        {{- end}}
    {{- end}}
{{- end}}
</code></pre>
<p>This iterates over all <code>envFrom</code> sections of all containers, and display <code>namespace/name - secretRefName</code> if any.</p>
<p>Then, use that template in <code>kubectl</code> to format your <code>Deployment</code>s and <code>StatefulSet</code>s. You could technically pass the template like this: <code>--o=gotemplate='{{...]}}'</code>, but I found it rather difficult to read, so I'd rather write it in a separate file (but it's just my opinion).</p>
<pre class="lang-bash prettyprint-override"><code>kubectl get -A deploy,statefulsets -o=go-template-file=list_secrets.tmpl
</code></pre>
<p>You should get something like:</p>
<pre><code>Deployment      default/app1 - secret1
Deployment      default/app2 - secret1
StatefulSet     default/app3 - secret1
StatefulSet     default/app3 - secret3
</code></pre>
<p>From there, you can do whatever you want, some examples of what you can achieve below.</p>
<h3>List only <code>Deployment</code>s/<code>StatefulSet</code>s with a particular secret</h3>
<p>Here, <code>secret1</code> for example (see <code>{{- if eq .secretRef.name &quot;secret1&quot;}}</code> to check name equality).</p>
<pre><code>{{- range .items}}
    {{- $namespaceAndName := (printf &quot;%s\t%s/%s&quot; .kind .metadata.namespace .metadata.name)}}
    {{- range .spec.template.spec.containers}}
        {{- range .envFrom}}
            {{- if eq .secretRef.name &quot;secret1&quot;}}
                {{- $namespaceAndName}}{{- &quot; - &quot;}}{{- .secretRef.name}}{{- &quot;\n&quot;}}
            {{- end}}
        {{- end}}
    {{- end}}
{{- end}}
</code></pre>
<h3>Get secrets mounted as volumes</h3>
<p>Here, we have to iterate over volumes rather than containers.</p>
<pre><code>{{- range .items}}
    {{- $namespaceAndName := (printf &quot;%s\t%s/%s&quot; .kind .metadata.namespace .metadata.name)}}
    {{- range .spec.template.spec.volumes}}
        {{- if .secret }}
            {{- $namespaceAndName}}{{- &quot; - &quot;}}{{- .secret.secretName}}{{- &quot;\n&quot;}}
        {{- end}}
    {{- end}}
{{- end}}
</code></pre>
<h3>Get secrets mounted as env vars <strong>and</strong> volumes</h3>
<p>This is a mix of the previous solutions; we also add details if the secret is used as env vars or volumes.</p>
<pre><code>{{- range .items}}
    {{- $namespaceAndName := (printf &quot;%s\t%s/%s&quot; .kind .metadata.namespace .metadata.name)}}
    {{- range .spec.template.spec.containers}}
        {{- range .envFrom}}
            {{- $namespaceAndName}}{{- &quot; - &quot;}}{{- .secretRef.name}}{{- &quot; (env)\n&quot;}}
        {{- end}}
    {{- end}}
    {{- range .spec.template.spec.volumes}}
        {{- if .secret }}
            {{- $namespaceAndName}}{{- &quot; - &quot;}}{{- .secret.secretName}}{{- &quot; (volume)\n&quot;}}
        {{- end}}
    {{- end}}
{{- end}}
</code></pre>
<p>This will print:</p>
<pre><code>Deployment      default/app1 - secret1 (env)
Deployment      default/app1 - secret1 (volume)
Deployment      default/app2 - secret1 (env)
StatefulSet     default/app3 - secret1 (env)
StatefulSet     default/app3 - secret3 (env)
</code></pre>
