AFAIK administrators can use exec to execute commands in a container running in kubernetes. This means that they can see all the secrets correct?
Now if the secret is used to connect to something externally, which that administrator does not have access to, how can I avoid that the adminstrator gets access to that external system?
Do I need to use something like Hashicorps Vault?
Do I need to use something like Hashicorps Vault?
Generally, yes: you need an external encrypted source in order to separate secret management (readable by admins with the right RBAC) and secrets.
For instance, something like hashicorp/vault-plugin-auth-kubernetes can help and allows for Kubernetes Service Accounts to authenticate with Vault.