my 300 lines eBPF tool inspects which pods are reading your K8s secrets
Open sourced my weekend project
I built a 300 lines eBPF tool that shows which pods are reading your K8s secrets and how often.
This weekend I deployed a malicious pod on my cluster (deliberately), testing a feature I’m building.
My feature lit up. Secret reads through the roof.
Good, but now I got curious what is it actually doing...
Exfiltrating tokens? Bruteforcing secret paths to find what’s mounted?
Probing every secret it can reach?
Only the kernel sees everything. So I hooked an eBPF probe to the node:pod: totally-legit-app
secret: serviceaccount/token
reads_per_sec: 4,872
cached: false
4,872 secret reads per second, while the pod’s logs just said “processing batch job.” Invisible to anything except the kernel.
If you’ve ever rotated a secret and watched a service crash, this is why.
A pod caching the secret in memory won’t even notice you rotated it.
A pod reading it 5,000 times per second will break the moment you touch it.
Nothing tells you what is the behavior you’re dealing with, you have to feel it.
No existing tool tracks secret access frequency per pod, so I built one.
50 lines of BPF C hooking the ‘openat’ syscall, sitting inside the kernel, telling you exactly who reads what.
My weekend project turned into an open source tool. Yours if you want it: GitHub
