Creating Secrets in Kubernetes - Step-by-Step CLI Walkthrough

Introduction

Sometimes you need to store sensitive information like passwords or keys safely in your system. Kubernetes Secrets help you keep this data secure and separate from your application code.

When you want to store a database password securely for your app to use.

When you need to keep API keys hidden from your application code.

When you want to share TLS certificates safely between pods.

When you want to avoid putting sensitive data directly in configuration files.

When you want to update sensitive data without rebuilding your app.

Config File - secret.yaml

secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  namespace: default
type: Opaque
data:
  username: bXl1c2Vy
  password: c2VjdXJlcGFzcw==

This file creates a Secret named my-secret in the default namespace.

The type: Opaque means it holds arbitrary user-defined data.

The data section stores key-value pairs where values are base64 encoded strings. Here, username is "myuser" encoded and password is "securepass" encoded.

Commands

This command creates the Secret in Kubernetes using the configuration file. It stores the sensitive data safely in the cluster.

Terminal

kubectl apply -f secret.yaml

Expected Output

secret/my-secret created

This command retrieves the Secret details in YAML format so you can verify it was created correctly.

Terminal

kubectl get secret my-secret -o yaml

Expected Output

apiVersion: v1

data:

  password: c2VjdXJlcGFzcw==

  username: bXl1c2Vy

kind: Secret

metadata:

  creationTimestamp: "2024-06-01T12:00:00Z"

  name: my-secret

  namespace: default

  resourceVersion: "12345"

  uid: abcdef12-3456-7890-abcd-ef1234567890

type: Opaque

→

-o yaml - Outputs the secret details in YAML format

This command shows a summary of the Secret without revealing the actual secret data, useful for quick checks.

Terminal

kubectl describe secret my-secret

Expected Output

Name:         my-secret

Namespace:    default

Labels:       <none>

Annotations:  <none>

Type:         Opaque

Data

====

password:  10 bytes

username:  6 bytes

Key Concept

If you remember nothing else from this pattern, remember: Kubernetes Secrets store sensitive data encoded and separate from your app to keep it safe.

Common Mistakes

Putting plain text passwords directly in the Secret YAML without base64 encoding.

Kubernetes requires Secret data to be base64 encoded; plain text will cause errors or be rejected.

Always encode your secret values using base64 before adding them to the Secret YAML.

Using 'kubectl get secret' without '-o yaml' and expecting to see the secret values.

By default, secret data is shown as base64 encoded or hidden; you won't see the actual values.

Use 'kubectl get secret my-secret -o yaml' and decode the base64 values to see the real data.

Committing Secret YAML files with sensitive data to public repositories.

Even though data is base64 encoded, it is not encrypted and can be easily decoded by anyone.

Keep Secret files out of public repos or use external secret management tools.

Summary

Create a Secret YAML file with base64 encoded sensitive data.

Apply the Secret to the Kubernetes cluster using 'kubectl apply -f'.

Verify the Secret exists and inspect it safely with 'kubectl get secret' and 'kubectl describe secret'.

Practice

1. What is the main purpose of creating a Secret in Kubernetes?

easy

A. To store sensitive information like passwords and tokens securely

B. To create a backup of your application data

C. To increase the number of pods in a deployment

D. To monitor the health of your cluster nodes

Solution

1. Step 1: Understand what Secrets are for

   Secrets in Kubernetes are designed to hold sensitive data such as passwords, tokens, or keys safely.

2. Step 2: Compare options with the purpose

   Only To store sensitive information like passwords and tokens securely describes storing sensitive info securely, which matches the purpose of Secrets.

3. Final Answer:

   To store sensitive information like passwords and tokens securely -> Option A

4. Quick Check:

   Secrets store sensitive info = B [OK]

Hint: Secrets = safe storage for sensitive data [OK]

Common Mistakes:

• Confusing Secrets with backups
• Thinking Secrets manage pods or nodes
• Assuming Secrets are for monitoring

2. Which of the following is the correct command to create a generic secret named mysecret with a literal key-value pair username=admin?

easy

A. kubectl create secret generic mysecret --from-literal=username=admin

B. kubectl secret create generic mysecret --literal=username=admin

C. kubectl create secret mysecret --literal username=admin

D. kubectl create secret generic mysecret username=admin

Solution

1. Step 1: Recall the correct syntax for creating a generic secret

   The correct command uses kubectl create secret generic [name] --from-literal=key=value.

2. Step 2: Match the options with the correct syntax

   Only kubectl create secret generic mysecret --from-literal=username=admin matches the exact syntax with correct flags and order.

3. Final Answer:

   kubectl create secret generic mysecret --from-literal=username=admin -> Option A

4. Quick Check:

   Correct syntax uses --from-literal=key=value = D [OK]

Hint: Use --from-literal=key=value with create secret generic [OK]

Common Mistakes:

• Using wrong flag names like --literal
• Omitting 'generic' keyword
• Incorrect order of arguments

3. What will be the output of the command kubectl get secret mysecret -o yaml after creating a secret with kubectl create secret generic mysecret --from-literal=password=pass123?

medium

A. The secret will not appear in the output

B. The password will be shown in plain text under data field

C. The password will be base64 encoded under data field

D. An error will occur because secrets cannot be viewed

Solution

1. Step 1: Understand how Kubernetes stores secret data

   Kubernetes stores secret values base64 encoded in the data field when viewed in YAML or JSON.

2. Step 2: Analyze the command output

   The command shows the secret in YAML format with the password base64 encoded, not plain text.

3. Final Answer:

   The password will be base64 encoded under data field -> Option C

4. Quick Check:

   Secrets data is base64 encoded = A [OK]

Hint: Secrets data shown base64 encoded, not plain text [OK]

Common Mistakes:

• Expecting plain text output
• Thinking secrets are hidden completely
• Assuming error when viewing secrets

4. You tried to create a secret with the command kubectl create secret generic mysecret --from-literal password pass123 but got an error. What is the likely cause?

medium

A. You need to add --type=generic flag explicitly

B. Secret name 'mysecret' is invalid

C. The password value is too short

D. Missing '=' sign between key and value in --from-literal

Solution

1. Step 1: Check the syntax of --from-literal flag

   The correct syntax requires an '=' sign between key and value, like --from-literal=key=value.

2. Step 2: Identify the error in the command

   The command uses a space instead of '=', causing a syntax error.

3. Final Answer:

   Missing '=' sign between key and value in --from-literal -> Option D

4. Quick Check:

   --from-literal needs '=' between key and value = A [OK]

Hint: Use '=' in --from-literal key=value, no spaces [OK]

Common Mistakes:

• Using space instead of '=' in --from-literal
• Assuming secret name rules cause error
• Thinking --type=generic is mandatory

5. You want to create a secret from a file named config.txt and also add a literal key env=prod. Which command correctly does this?

hard

A. kubectl create secret generic appsecret --from-file=config.txt env=prod

B. kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod

C. kubectl create secret generic appsecret --from-literal=config.txt --from-literal=env=prod

D. kubectl create secret generic appsecret --from-file=config.txt --literal=env=prod

Solution

1. Step 1: Understand how to add file and literal to secret

   Use --from-file=filename to add file content and --from-literal=key=value for literals.

2. Step 2: Check options for correct syntax

   kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod correctly uses both flags with proper syntax; others misuse flags or omit '='.

3. Final Answer:

   kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod -> Option B

4. Quick Check:

   Use --from-file and --from-literal together correctly = C [OK]

Hint: Combine --from-file and --from-literal with '=' correctly [OK]

Common Mistakes:

• Using --from-literal for file instead of --from-file
• Omitting '=' in --from-literal
• Mixing flags incorrectly