Sign in Get started

Kubernetes Tutorial · Configuration and Resources · Lesson 18 of 26

Secrets

Store credentials in Secrets, understand that base64 is not encryption, and protect them properly.

Create a free account to save this page, take notes and track your progress. Sign in

What a Secret is (and isn't)

A Secret holds sensitive values and is consumed like a ConfigMap. Its data is base64-encoded, not encrypted: anyone who can read Secrets in the namespace can read the values. Protect them:

  • RBAC: few people and service accounts may get/list Secrets.
  • Encryption at rest for etcd (managed clusters usually do this, or use a KMS provider).
  • External secret stores (cloud secret managers, Vault) synced by the External Secrets Operator or the Secrets Store CSI driver; or sealed/encrypted secrets in Git (Sealed Secrets, SOPS).
  • Never commit plain Secret manifests to Git.
base64 is encoding, not encryption
kubectl create namespace demo-secrets > /dev/null
trap 'kubectl delete namespace demo-secrets --wait=false > /dev/null' EXIT
kubectl -n demo-secrets create secret generic db-creds --from-literal=username=app --from-literal=password='s3cr3t!' > /dev/null
echo "stored value: $(kubectl -n demo-secrets get secret db-creds -o jsonpath='{.data.password}')"
echo "decoded:      $(kubectl -n demo-secrets get secret db-creds -o jsonpath='{.data.password}' | base64 -d)"
kubectl -n demo-secrets run app --restart=Never --image=busybox:1.37 --overrides='{"spec":{"containers":[{"name":"app","image":"busybox:1.37","command":["sh","-c","echo connecting as $DB_USER"],"env":[{"name":"DB_USER","valueFrom":{"secretKeyRef":{"name":"db-creds","key":"username"}}}]}]}}' > /dev/null
kubectl -n demo-secrets wait --for=jsonpath='{.status.phase}'=Succeeded pod/app --timeout=120s > /dev/null
kubectl -n demo-secrets logs app

Output

stored value: czNjcjN0IQ==
decoded:      s3cr3t!
connecting as app

Run this on your computer — see “Get Started” for setup.

See Secrets and Good practices for Secrets.

Test yourself

Is a Kubernetes Secret encrypted by default?

  1. Yes, with AES
  2. No: data is base64-encoded; protect it with RBAC, encryption at rest or external secret stores
  3. Only in production namespaces
  4. Yes, by the kubelet
Show answer

Answer: No: data is base64-encoded; protect it with RBAC, encryption at rest or external secret stores

Anyone allowed to read the Secret can decode it.

Was this page helpful?