Secrets Should Be Encrypted At Rest

#!/usr/bin/env bash
#
# Check Secret encryption-at-rest status on an OKE cluster (best-effort)
# Requirements:
#   - kubectl configured to talk to the target OKE cluster
#   - jq installed
#
# Run from: any machine with kubectl access

set -euo pipefail

echo "== OKE Secret Encryption-at-Rest Review =="

echo
echo "1) Describe all Kubernetes Secrets (redact data) to support manual review"
echo "   (This does NOT prove encryption at rest; it only helps identify"
echo "    unexpected or sensitive secrets that should be protected by envelope/KMS encryption.)"
echo

# List all namespaces
namespaces=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

for ns in $namespaces; do
  echo "Namespace: $ns"
  # Show metadata and type only (do not show secret data)
  kubectl get secrets -n "$ns" -o custom-columns=NAME:.metadata.name,TYPE:.type,AGE:.metadata.creationTimestamp --no-headers || true
  echo
done

echo "---------------------------------------------------------------"
echo "2) Detect Secrets that look like they might contain raw credentials"
echo "   (e.g., generic Opaque secrets with likely credential key names)"
echo

suspicious_keys='(?i)(password|passwd|token|secret|apikey|api_key|access_key|private_key|cert|certificate)'

kubectl get secrets --all-namespaces -o json \
  | jq -r --arg re "$suspicious_keys" '
    .items[]
    | . as $s
    | ($s.data // {}) as $d
    | [keys_unsorted[] | select(test($re))] as $sus
    | select($sus | length > 0)
    | "\($s.metadata.namespace) \($s.metadata.name) \($s.type) keys=" + ($sus | join(","))' \
  || true

echo
echo "If you see many sensitive Opaque secrets above, ensure OKE envelope/KMS"
echo "encryption is enabled at the cluster level via the OCI Console/CLI/IaC."
echo
echo "NOTE: On OKE, whether etcd uses KMS envelope encryption for Secrets is"
echo "configured on the control plane (Oracle-managed). It is NOT visible or"
echo "changeable via kubectl. This script only helps you identify secrets that"
echo "should be protected and to prioritize clusters for review in OCI."