Secrets

Secrets — Managing Sensitive Data

A Secret stores sensitive data like passwords, tokens, and API keys. Secrets are similar to ConfigMaps but are designed for confidential information.

Important: Secrets are only base64-encoded by default, not encrypted. For true encryption, enable encryption at rest or use a secrets management tool.

Creating Secrets

# From literal values
kubectl create secret generic my-secret \
  --from-literal=username=admin \
  --from-literal=password=s3cr3t

# From a file
kubectl create secret tls my-tls \
  --cert=tls.crt \
  --key=tls.key

# YAML definition (values must be base64-encoded)
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  username: YWRtaW4=      # echo -n 'admin' | base64
  password:czNjcjN0       # echo -n 's3cr3t' | base64

Using Secrets

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
    - name: app
      image: my-app
      env:
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: password
      volumeMounts:
        - name: secret-volume
          mountPath: /etc/secrets
          readOnly: true
  volumes:
    - name: secret-volume
      secret:
        secretName: my-secret

As environment variables — Individual keys are injected as env vars.

As files — Each key becomes a file in the mounted directory.

Secret Types

  Type                          │ Use Case
  ──────────────────────────────┼──────────────────────────
  Opaque                        │ Generic key-value pairs
  kubernetes.io/tls              │ TLS certificates
  kubernetes.io/dockerconfigjson │ Docker registry auth
  kubernetes.io/basic-auth      │ Basic auth credentials
  kubernetes.io/ssh-auth        │ SSH private keys

Securing Secrets

Enable encryption at rest — Configure Kubernetes to encrypt Secrets in etcd.

Use external secret stores — Tools like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault integrate with Kubernetes.

Limit access with RBAC — Restrict who can read Secrets in your cluster.

Rotate regularly — Update Secrets periodically and use automated rotation tools.