secret isn't blocked for non-admin user but secrets is

[estein9825]

Expected vs actual behavior

If you run kubectl get secret for a read-only user then it works, whereas kubectl get secrets doesn't.

Steps to reproduce the bug

1. Grant readonly rights to user
2. Run kubectl get pods -o json | jq '.items[].spec.containers[].env[]?.valueFrom.secretKeyRef.name' | grep -v null | uniq command for authorized namespace
3. Secrets should return
4. Run kubectl get secret <secret_name> and it works

Are you using the latest version of the project?

Using version 2.0

What is your environment setup? Please tell us your cloud provider, operating system, and include the output of kubectl version --output=yaml and helm version. Any other information that you have, eg. logs and custom values, is highly appreciated!

Kubernetes 1.24

(optional) If you have ideas on why the bug happens or how it can be solved, please provide it here

The guard against secrets should be a wildcard so that it can protect against secret and sec

• [X ] I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.
• I'm using the latest version of the project.

[akshay196]

@estein9825 Are you getting any error for kubectl get secrets? If yes, please paste it here.

[estein9825]

Yes, get secrets (with an s) is blocked with an unauthorized error as desired.

[nirav-rafay]

so with paralus, any user with read only permission is not allowed to view secrets.

In this case kubectl get secrets works fine however read only user is able to view secret using kubectl get secret <name> thus causing an escalation privilege or unauthorised access to a resource which ideally should be blocked for read only users.