Kubernetes Secrets

What Is a Secret?

A Secret stores sensitive data such as passwords, API tokens, TLS certificates, or registry credentials.

Common Secret Types

Important Security Note

Base64 encoding is not encryption. It only changes representation. In production, use stronger controls such as encryption at rest, tight RBAC, external secret managers, Vault, or Sealed Secrets.

Create a Secret Imperatively

kubectl create secret generic app-secret   --from-literal=DB_PASSWORD=supersecret

Create a Secret from YAML

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
type: Opaque
data:
  DB_PASSWORD: c3VwZXJzZWNyZXQ=

Use a Secret as an Environment Variable

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-demo
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ['sh', '-c', 'echo Secret loaded && sleep 3600']
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: app-secret
              key: DB_PASSWORD

Use a Secret as a Mounted Volume

apiVersion: v1
kind: Pod
metadata:
  name: secret-file-demo
spec:
  volumes:
    - name: secret-volume
      secret:
        secretName: app-secret
  containers:
    - name: app
      image: busybox:1.36
      command: ['sh', '-c', 'ls /secrets && sleep 3600']
      volumeMounts:
        - name: secret-volume
          mountPath: /secrets
          readOnly: true

Private Registry Access with imagePullSecrets

apiVersion: v1
kind: Pod
metadata:
  name: private-image-demo
spec:
  imagePullSecrets:
    - name: regcred
  containers:
    - name: app
      image: private-registry.example.com/demo:1.0

Best Practices

• grant least-privilege RBAC
• avoid printing secret values in logs
• prefer volume mounts for some sensitive file use cases
• use external secret tooling in production