Detects GKE Secrets API activity originating from node identities or denied service accounts in Google Kubernetes Engine (GKE) audit logs. The rule flags two high-confidence patterns: (1) system:node:* calling secrets.get or secrets.list, and (2) system:serviceaccount:* receiving event.outcome: failure on secrets.get. Node-originated access is considered high priority because kubelet, CSI, or maintenance tooling on nodes should not enumerate or read Secrets; a denied service-account read may indicate token probing or RBAC overreach. The detection uses the gcp.audit data stream and requires the GCP Fleet integration with GKE audit logs enabled. Matches contribute to a medium severity alert (risk_score 47) and map to MITRE ATT&CK Credential Access (TA0006) with T1552.007 (Container API). The rule filters non-local source IPs and targets specific GKE Secrets API actions (io.k8s.core.v1.secrets.get/list) or failed secrets.get for service accounts. The alert is timestamped on event.ingested. The accompanying investigation guidance (in the rule) suggests correlating with resource_name, user_agent.original, and other secret-access events (token creation, pod exec, RoleBinding changes) and reviewing RBAC bindings to determine if access is legitimate. It is intended for use with the GCP Fleet integration and GKE audit logs to surface potential credential-access activity in cluster workloads and nodes.