watch secrets
Every Secret create and update streams back with full data in real time, including new credentials, manually created ServiceAccount token Secrets, TLS keys, imagePullSecrets, and application secrets.
TokenRequest responses and projected bound tokens don't flow through Secret watch.
Note:
Kubernetes v1.24 stopped auto-creating long-lived ServiceAccount token Secrets by default, but manually-created service-account-token Secrets remain supported and legacy token Secrets may still exist.
- API Group
- (core)
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
list or watch secrets cluster-wide, or in kube-system alone, and receive every Secret's data in the response.
Auto-created ServiceAccount token Secrets are gone from modern clusters, so what is harvested is whatever was deliberately stored.
That is the credential material the cluster actually runs on, including registry pull secrets, database and cloud credentials, TLS private keys, and any long-lived token created on purpose.
Revoking the permission afterwards does not undo the exposure.
Every credential returned stays valid until it is individually identified and rotated.
Additional rights needed: