Base64 encoding in Secrets in Kubernetes - Step-by-Step Execution

Process Flow - Base64 encoding in Secrets

Start with plain text secret

↓

Encode secret in Base64

↓

Create Kubernetes Secret YAML

↓

Apply Secret to cluster

↓

Secret stored with Base64 encoded data

↓

Pods can decode and use secret

This flow shows how plain text secrets are encoded in Base64 before being stored in Kubernetes Secrets, which pods then decode to use.

Execution Sample

Kubernetes

echo -n 'mypassword' | base64
kubectl create secret generic mysecret --from-literal=password=mypassword
kubectl get secret mysecret -o yaml

Encode 'mypassword' to Base64, create a secret with it, then view the secret YAML showing Base64 encoded data.

Process Table

Step	Command/Action	Input	Output/Result	Explanation
1	echo -n 'mypassword' | base64	mypassword	bXlwYXNzd29yZA==	Plain text 'mypassword' encoded to Base64 string
2	kubectl create secret generic mysecret --from-literal=password=mypassword	password=mypassword	secret/mysecret created	Secret created with Base64 encoding applied internally
3	kubectl get secret mysecret -o yaml	mysecret	password: bXlwYXNzd29yZA==	Secret data shown in Base64 encoded form
4	Pod reads secret	bXlwYXNzd29yZA==	mypassword	Pod decodes Base64 to get original password
5	End			Secret stored and used securely with Base64 encoding

💡 Secret is stored encoded; pods decode it to use the original secret.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
secret_plaintext	mypassword	mypassword	mypassword	mypassword	mypassword
secret_base64		bXlwYXNzd29yZA==	bXlwYXNzd29yZA==	bXlwYXNzd29yZA==	bXlwYXNzd29yZA==
secret_stored			Stored as Base64 in cluster	Shown as Base64 in YAML	Used decoded by pod

Key Moments - 3 Insights

Why do we see Base64 encoded strings in the secret YAML instead of plain text?

Kubernetes stores secret data in Base64 encoding to safely handle binary data and avoid formatting issues. See execution_table step 3 where the secret data is shown encoded.

Does Base64 encoding secure the secret from being read by others?

No, Base64 is just encoding, not encryption. It only changes the format. The secret is still sensitive and access should be controlled. See execution_table step 1 and 3 for encoding vs storage.

How does a pod use the secret if it is stored encoded?

Pods decode the Base64 string back to the original secret before use. See execution_table step 4 where pod decodes the secret.

Visual Quiz - 3 Questions

Look at the execution table, what is the Base64 encoded value of 'mypassword' at step 1?

A bXlwYXNzd29yZA

B cGFzc3dvcmQ=

C bXlwYXNzd29yZA==

D bXlwYXNzd29yZA===

💡 Hint

Check the Output/Result column at step 1 in the execution_table.

At which step is the secret actually created in the Kubernetes cluster?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the Command/Action and Explanation columns in execution_table.

If the pod did not decode the Base64 secret, what would it see?

A The original password 'mypassword'

B The Base64 string 'bXlwYXNzd29yZA=='

C An error because secret is missing

D An empty string

💡 Hint

Refer to execution_table step 4 where pod decodes the secret.

Concept Snapshot

Base64 encoding converts plain text secrets into a safe string format.
Kubernetes Secrets store data in Base64 encoded form.
Use 'echo -n "text" | base64' to encode manually.
Pods decode Base64 to use the original secret.
Base64 is encoding, not encryption; control access carefully.

Full Transcript

This visual execution shows how Kubernetes handles secrets using Base64 encoding. First, the plain text secret 'mypassword' is encoded into Base64 as 'bXlwYXNzd29yZA=='. Then, a Kubernetes Secret is created using this data, which is stored encoded inside the cluster. When viewing the secret YAML, the data appears as the Base64 string. Finally, pods that use the secret decode the Base64 string back to the original password to use it securely. Base64 encoding ensures safe storage format but does not encrypt the secret, so access control is important.

Practice

1. What is the main reason Kubernetes Secrets use Base64 encoding for their data?

easy

A. To compress the secret data to save space

B. To encrypt the secret data for security

C. To convert binary data into text format for safe storage

D. To convert text data into binary format for faster access

Solution

1. Step 1: Understand Base64 encoding purpose

   Base64 encoding changes binary data into readable text characters so it can be stored in text files or systems.

2. Step 2: Apply to Kubernetes Secrets

   Kubernetes Secrets store sensitive data as text in YAML files, so Base64 encoding is used to safely represent binary or special characters as text.

3. Final Answer:

   To convert binary data into text format for safe storage -> Option C

4. Quick Check:

   Base64 encoding = text format for storage [OK]

Hint: Base64 makes binary data safe as text in Secrets [OK]

Common Mistakes:

• Thinking Base64 encrypts data
• Confusing Base64 with compression
• Assuming Base64 changes data speed

2. Which of the following is the correct YAML snippet for a Kubernetes Secret with a key named password and value cGFzc3dvcmQ= (Base64 encoded)?

easy

A. apiVersion: v1
kind: Secret
stringData:
password: cGFzc3dvcmQ=

B. apiVersion: v1
kind: Secret
data:
password: cGFzc3dvcmQ=

C. apiVersion: v1
kind: Secret
secrets:
password: cGFzc3dvcmQ=

D. apiVersion: v1
kind: Secret
values:
password: cGFzc3dvcmQ=

Solution

1. Step 1: Identify correct field for Base64 data

   Kubernetes Secrets use the data field to store Base64 encoded values.

2. Step 2: Check YAML structure

   The correct YAML must have apiVersion, kind, and data with the key and Base64 value.

3. Final Answer:

   apiVersion: v1 kind: Secret data: password: cGFzc3dvcmQ= -> Option B

4. Quick Check:

   Base64 data goes under data field [OK]

Hint: Base64 values go under 'data', not 'stringData' or others [OK]

Common Mistakes:

• Using stringData for Base64 encoded values
• Wrong field names like secrets or values
• Missing apiVersion or kind fields

3. Given this command:
kubectl create secret generic mysecret --from-literal=username=admin --from-literal=password=pass123
What will be the Base64 encoded value of the password key in the Secret?

medium

A. cGFzczEyMw==

B. cGFzc3dvcmQ=

C. cGFzc3dvcmQxMjM=

D. cGFzc3dvcmQxMjM0

Solution

1. Step 1: Identify the literal value for password

   The password literal is pass123.

2. Step 2: Base64 encode 'pass123'

   Encoding 'pass123' in Base64 results in cGFzczEyMw==.

3. Final Answer:

   cGFzczEyMw== -> Option A

4. Quick Check:

   Base64('pass123') = cGFzczEyMw== [OK]

Hint: Encode exact literal value, not similar words [OK]

Common Mistakes:

• Encoding 'password' instead of 'pass123'
• Missing padding characters '=='
• Confusing similar Base64 strings

4. You created a Secret YAML with this data field:
data: apiKey: mysecretkey
What is the problem with this Secret definition?

medium

A. The value 'mysecretkey' is not Base64 encoded

B. The key 'apiKey' is invalid in Secrets

C. The data field should be named stringData

D. The Secret kind is missing

Solution

1. Step 1: Check the data field requirements

   The data field requires Base64 encoded values, not plain text.

2. Step 2: Identify the error in the value

   The value 'mysecretkey' is plain text and must be Base64 encoded before placing under data.

3. Final Answer:

   The value 'mysecretkey' is not Base64 encoded -> Option A

4. Quick Check:

   data values must be Base64 encoded [OK]

Hint: data field values must be Base64, else error [OK]

Common Mistakes:

• Putting plain text in data instead of Base64
• Confusing data with stringData field
• Ignoring required apiVersion and kind fields

5. You want to create a Kubernetes Secret from a file config.json containing JSON data. Which command correctly creates the Secret with Base64 encoding handled automatically?

hard

A. kubectl create secret generic myconfig --from-file=config.json --encode

B. kubectl create secret generic myconfig --from-literal=config.json=$(cat config.json | base64)

C. kubectl create secret generic myconfig --from-literal=config.json=config.json

D. kubectl create secret generic myconfig --from-file=config.json

Solution

1. Step 1: Understand kubectl create secret from-file option

   The --from-file option reads the file and automatically Base64 encodes its content for the Secret.

2. Step 2: Evaluate other options

   kubectl create secret generic myconfig --from-literal=config.json=$(cat config.json | base64) manually encodes but is unnecessary; kubectl create secret generic myconfig --from-literal=config.json=config.json uses literal text; kubectl create secret generic myconfig --from-file=config.json --encode uses a non-existent flag.

3. Final Answer:

   kubectl create secret generic myconfig --from-file=config.json -> Option D

4. Quick Check:

   Use --from-file to auto Base64 encode files [OK]

Hint: Use --from-file to auto Base64 encode file content [OK]

Common Mistakes:

• Manually encoding file content before command
• Using wrong flags like --encode
• Passing file name as literal string