Base64 encoding in Secrets in Kubernetes - Step-by-Step Execution

Process Flow - Base64 encoding in Secrets

Start with plain text secret

↓

Encode secret in Base64

↓

Create Kubernetes Secret YAML

↓

Apply Secret to cluster

↓

Secret stored with Base64 encoded data

↓

Pods can decode and use secret

This flow shows how plain text secrets are encoded in Base64 before being stored in Kubernetes Secrets, which pods then decode to use.

Execution Sample

Kubernetes

echo -n 'mypassword' | base64
kubectl create secret generic mysecret --from-literal=password=mypassword
kubectl get secret mysecret -o yaml

Encode 'mypassword' to Base64, create a secret with it, then view the secret YAML showing Base64 encoded data.

Process Table

Step	Command/Action	Input	Output/Result	Explanation
1	echo -n 'mypassword' | base64	mypassword	bXlwYXNzd29yZA==	Plain text 'mypassword' encoded to Base64 string
2	kubectl create secret generic mysecret --from-literal=password=mypassword	password=mypassword	secret/mysecret created	Secret created with Base64 encoding applied internally
3	kubectl get secret mysecret -o yaml	mysecret	password: bXlwYXNzd29yZA==	Secret data shown in Base64 encoded form
4	Pod reads secret	bXlwYXNzd29yZA==	mypassword	Pod decodes Base64 to get original password
5	End			Secret stored and used securely with Base64 encoding

💡 Secret is stored encoded; pods decode it to use the original secret.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
secret_plaintext	mypassword	mypassword	mypassword	mypassword	mypassword
secret_base64		bXlwYXNzd29yZA==	bXlwYXNzd29yZA==	bXlwYXNzd29yZA==	bXlwYXNzd29yZA==
secret_stored			Stored as Base64 in cluster	Shown as Base64 in YAML	Used decoded by pod

Key Moments - 3 Insights

Why do we see Base64 encoded strings in the secret YAML instead of plain text?

Kubernetes stores secret data in Base64 encoding to safely handle binary data and avoid formatting issues. See execution_table step 3 where the secret data is shown encoded.

Does Base64 encoding secure the secret from being read by others?

No, Base64 is just encoding, not encryption. It only changes the format. The secret is still sensitive and access should be controlled. See execution_table step 1 and 3 for encoding vs storage.

How does a pod use the secret if it is stored encoded?

Pods decode the Base64 string back to the original secret before use. See execution_table step 4 where pod decodes the secret.

Visual Quiz - 3 Questions

Look at the execution table, what is the Base64 encoded value of 'mypassword' at step 1?

A bXlwYXNzd29yZA

B cGFzc3dvcmQ=

C bXlwYXNzd29yZA==

D bXlwYXNzd29yZA===

💡 Hint

Check the Output/Result column at step 1 in the execution_table.

At which step is the secret actually created in the Kubernetes cluster?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the Command/Action and Explanation columns in execution_table.

If the pod did not decode the Base64 secret, what would it see?

A The original password 'mypassword'

B The Base64 string 'bXlwYXNzd29yZA=='

C An error because secret is missing

D An empty string

💡 Hint

Refer to execution_table step 4 where pod decodes the secret.

Concept Snapshot

Base64 encoding converts plain text secrets into a safe string format.
Kubernetes Secrets store data in Base64 encoded form.
Use 'echo -n "text" | base64' to encode manually.
Pods decode Base64 to use the original secret.
Base64 is encoding, not encryption; control access carefully.

Full Transcript

This visual execution shows how Kubernetes handles secrets using Base64 encoding. First, the plain text secret 'mypassword' is encoded into Base64 as 'bXlwYXNzd29yZA=='. Then, a Kubernetes Secret is created using this data, which is stored encoded inside the cluster. When viewing the secret YAML, the data appears as the Base64 string. Finally, pods that use the secret decode the Base64 string back to the original password to use it securely. Base64 encoding ensures safe storage format but does not encrypt the secret, so access control is important.