Creating Secrets in Kubernetes - Visual Walkthrough

Process Flow - Creating Secrets

Write secret data

↓

Encode data in base64

↓

Create Secret YAML manifest

↓

Apply manifest with kubectl

↓

Secret stored in cluster

↓

Use secret in pods or configs

This flow shows how secret data is prepared, encoded, saved in a YAML file, applied to the cluster, and then used securely.

Execution Sample

Kubernetes

kubectl create secret generic mysecret --from-literal=password=Pa$$w0rd
kubectl get secret mysecret -o yaml

Creates a secret named 'mysecret' with a password, then shows the secret details in YAML format.

Process Table

Step	Command	Action	Result
1	kubectl create secret generic mysecret --from-literal=password=Pa$$w0rd	Create secret named 'mysecret' with password	Secret 'mysecret' created
2	kubectl get secret mysecret -o yaml	Retrieve secret details in YAML	YAML output with base64 encoded password
3	kubectl describe secret mysecret	Show secret summary	Shows metadata and data keys (password)
4	kubectl delete secret mysecret	Delete the secret	Secret 'mysecret' deleted
5	-	No secret exists now	kubectl get secret mysecret returns 'NotFound' error

💡 Secret deleted and no longer exists in cluster

Status Tracker

Variable	Start	After Step 1	After Step 4	Final
Secret 'mysecret'	None	Exists with password key	Deleted	None

Key Moments - 3 Insights

Why is the password stored in base64 format in the secret YAML?

Base64 encoding is used to safely store binary or special characters in YAML. It is not encryption, just encoding. See execution_table step 2 where the password appears encoded.

What happens if you try to get a secret after deleting it?

kubectl returns a 'NotFound' error because the secret no longer exists. This is shown in execution_table step 5.

Can you see the actual password in plain text by running 'kubectl get secret'?

No, the password is base64 encoded in the output. You must decode it manually to see the plain text. This is shown in execution_table step 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the result of step 1?

A Secret 'mysecret' deleted

B Secret 'mysecret' created

C YAML output with base64 encoded password

D NotFound error

💡 Hint

Check the 'Result' column for step 1 in the execution_table.

At which step does the secret get deleted?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look for the 'Action' column mentioning deletion in the execution_table.

If you want to see the secret password in plain text, what must you do after step 2?

A Run 'kubectl delete secret mysecret'

B Run 'kubectl describe secret mysecret'

C Decode the base64 encoded password from the YAML output

D Nothing, it is already in plain text

💡 Hint

Refer to the key_moments about base64 encoding and step 2 output.

Concept Snapshot

Creating Secrets in Kubernetes:
- Use 'kubectl create secret generic NAME --from-literal=key=value'
- Secret data is base64 encoded in YAML
- Apply secret with kubectl to store in cluster
- Use 'kubectl get secret NAME -o yaml' to view encoded data
- Delete secret with 'kubectl delete secret NAME'

Full Transcript

Creating secrets in Kubernetes involves writing secret data, encoding it in base64, creating a YAML manifest, and applying it to the cluster using kubectl. The secret is stored securely and can be used by pods or configurations. The password or secret data is encoded in base64, not encrypted, so it must be decoded to read the original value. Secrets can be deleted, after which they no longer exist in the cluster.