Claude Code tried to dump your Kubernetes secret

You were in Claude Code. It went for cluster credentials the short way: kubectl get secret db-credentials -o yaml. If that runs, the whole Secret lands in the agent session as YAML. Database passwords, API tokens, TLS keys. They are base64, which is one decode away from plain text. You get the payload, not just the name and labels.

HOL Guard froze the read. Two buttons on screen: Allow just this once or Keep blocked. Until you tap Allow, the Secret dump has not started.

Keep blocked leaves the read stopped. The receipt stays on your machine.

Why kubectl get secret -o yaml is not a harmless debug step

kubectl get looks like inventory. Point it at a Secret with -o yaml and it becomes a credential export. Agents reach for it when a pod will not start, when a Helm chart needs a value, or when a prompt says "check the secret." You never typed the command, but the session still gets the bytes, and anything the agent does next can carry them somewhere else.

Other Extensions cover the next step. If the agent then curls those values off the laptop, that is command.data-protection. If it tries to clear the pause itself, that is command.guard-self-protection. This Extension only claims Kubernetes CLI reads that can reveal Secret payloads.

What Guard maps

Built-in Kubernetes secret protection (command.kubernetes-secrets, v1.0.0, Core safety). It has one operation, Cluster secret read, severity High, reviewed by default. Permission ID: command.kubernetes-secrets.permission.secret-read. It identifies cluster CLI operations that can reveal Secret payloads.

Catalog example: kubectl get secret db-credentials -o yaml.

A workspace can tighten this to block or loosen the floor, unless a managed-restrictive Control Set pins the Extension. The catalog default is not your fleet policy.

On Protect / Extensions, leave posture at Protected unless you have a deliberate reason to Watch. Watch will not stop the read.

Out of scope

command.kubernetes-secrets does not cover:

• Non-secret Kubernetes objects (Pods, Deployments, ConfigMaps without Secret material) when the reviewed operation is not a Secret payload read.
• Sending credentials or uploading files with curl: command.data-protection.
• Decode-and-execute chains: command.encoded-execution.
• An agent calling hol-guard approvals approve on itself: command.guard-self-protection.
• Package installs and one-shot runners: Package Firewall Extensions.

How do I stop Claude Code from reading Kubernetes secrets?

Install HOL Guard, keep command.kubernetes-secrets at Protected, then check it without touching the cluster. command test and command explain do not run the command, create an approval, or write a receipt.

hol-guard command test 'kubectl get secret db-credentials -o yaml'
hol-guard command explain 'kubectl get secret db-credentials -o yaml'
hol-guard command controls show command.kubernetes-secrets
hol-guard command extensions

Run the test again after an upgrade. If it says unrecognized, confirm the Extension is current and posture is not Watch.

After Inbox lights up

This pause is for Kubernetes CLI reads that can expose Secret payloads. A plain kubectl get pod is not in scope.

Change the permission in Protect / Extensions or from the CLI. For a team floor that local auto-approve cannot weaken, pin a managed-restrictive Control Set on command.kubernetes-secrets.permission.secret-read.

If you meant to dump the Secret, choose Allow just this once after you know why the agent needs the full YAML. If you did not, Keep blocked and ask which prompt pushed for credentials. The receipt stays local. Cloud sync is optional and does not carry the raw command.

Background: HOL Guard 3.0.