<p>I was reading the documentation about <code>kubernetes.io/dockerconfigjson</code>
and I just have a question: Is there any security risk to public publish <code>dockerconfigjson</code>? For example:</p>
<pre><code>    data:
  .dockerconfigjson: &lt;base64&gt;
</code></pre>

h4x0r_dz
<p>Posted community wiki answer for better visibility. Feel free to expand it.</p>
<hr />
<p>As suggested by David Maze's comment:</p>
<blockquote>
<p>I'd expect that to usually contain credentials to access your Docker registry...so yes, it'd be a significant security exposure to publish it?</p>
</blockquote>
<p>It's dangerous and not recommended because docker <code>config.json</code> imported to Kubernetes is mainly used <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">for keeping credentials used for pulling images</a> from private registry.</p>
<p>Even if it's saved in base64 format as in <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials" rel="nofollow noreferrer">example from Kubernetes docs</a> (in your example too) it can be easily decoded:</p>
<p><em>my-secret.yaml</em></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: myregistrykey
  namespace: awesomeapps
data:
  .dockerconfigjson: UmVhbGx5IHJlYWxseSByZWVlZWVlZWVlZWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGx5eXl5eXl5eXl5eXl5eXl5eXl5eSBsbGxsbGxsbGxsbGxsbG9vb29vb29vb29vb29vb29vb29vb29vb29vb25ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg==
type: kubernetes.io/dockerconfigjson
</code></pre>
<p>Let's decode it:</p>
<pre><code>user@shell:~/ $ cat my-secret.yaml | yq e '.data.&quot;.dockerconfigjson&quot;' - | base64 -d
Really really reeeeeeeeeeaaaaaaaaaaaaaaaaaaaaaaaaaaalllllllllllllllllllllllllllllllyyyyyyyyyyyyyyyyyyyy llllllllllllllooooooooooooooooooooooooooonnnnnnnnnnnnnnnnnnnnnnnnggggggggggggggggggg auth keys
</code></pre>
