Secret types (Opaque, docker-registry, TLS) in Kubernetes - Step-by-Step Execution

Process Flow - Secret types (Opaque, docker-registry, TLS)

Create Secret YAML

↓

kubectl apply secret

↓

Secret stored in Kubernetes

↓

Pod references Secret

↓

Secret data injected into Pod

↓

Pod uses Secret for auth/config

This flow shows how different secret types are created, stored, and used by pods in Kubernetes.

Execution Sample

Kubernetes

kubectl create secret generic mysecret --from-literal=key1=value1
kubectl create secret docker-registry regsecret --docker-username=user --docker-password=pass --docker-server=registry.example.com
kubectl create secret tls tlssecret --cert=cert.pem --key=key.pem

Commands to create three secret types: opaque, docker-registry, and TLS.

Process Table

Step	Command	Secret Type	Data Stored	Result
1	kubectl create secret generic mysecret --from-literal=key1=value1	Opaque	key1=value1	Opaque secret 'mysecret' created
2	kubectl create secret docker-registry regsecret --docker-username=user --docker-password=pass --docker-server=registry.example.com	docker-registry	username, password, server	Docker-registry secret 'regsecret' created
3	kubectl create secret tls tlssecret --cert=cert.pem --key=key.pem	TLS	tls.crt, tls.key	TLS secret 'tlssecret' created
4	kubectl get secret mysecret -o yaml	Opaque	key1: dmFsdWUx (base64)	Opaque secret data shown in base64
5	kubectl get secret regsecret -o yaml	docker-registry	.dockerconfigjson (base64)	Docker-registry secret data shown in base64
6	kubectl get secret tlssecret -o yaml	TLS	tls.crt, tls.key (base64)	TLS secret data shown in base64
7	Pod mounts secret 'mysecret'	Opaque	key1=value1	Pod can read key1 from secret
8	Pod uses 'regsecret' for image pull	docker-registry	auth to registry	Pod can pull private images
9	Pod uses 'tlssecret' for TLS	TLS	cert and key	Pod can establish secure connections
10	End	-	-	All secrets created and usable by pods

💡 All secret types created and verified for pod usage

Status Tracker

Secret Name	Before Creation	After Step 1	After Step 2	After Step 3	Final
mysecret	None	Opaque secret with key1=value1	Opaque secret with key1=value1	Opaque secret with key1=value1	Opaque secret with key1=value1
regsecret	None	None	Docker-registry secret with credentials	Docker-registry secret with credentials	Docker-registry secret with credentials
tlssecret	None	None	None	TLS secret with cert and key	TLS secret with cert and key

Key Moments - 3 Insights

Why is the secret data shown in base64 when we get the secret YAML?

Kubernetes encodes secret data in base64 for safe storage and transmission. See execution_table rows 4-6 where secret data is base64 encoded.

Can we use an opaque secret to store TLS certificates?

Technically yes, but Kubernetes has a special TLS secret type that expects specific keys (tls.crt and tls.key) for easier use. See steps 1 and 3 for difference.

How does a pod use a docker-registry secret?

The pod uses the docker-registry secret to authenticate to private container registries when pulling images. See execution_table row 8.

Visual Quiz - 3 Questions

Look at the execution table, what secret type is created at step 2?

A Opaque

B TLS

C docker-registry

D ConfigMap

💡 Hint

Check the 'Secret Type' column at step 2 in the execution_table.

At which step does the pod get the TLS secret data?

A Step 9

B Step 7

C Step 8

D Step 10

💡 Hint

Look for the step where the pod uses 'tlssecret' in the execution_table.

If you change the docker password in step 2, which part of the execution_table changes?

A Step 1 data

B Step 5 secret data

C Step 9 pod usage

D Step 4 opaque secret

💡 Hint

Changing docker password affects the secret data shown in step 5.

Concept Snapshot

Kubernetes Secrets store sensitive data.
Opaque: generic key-value pairs.
Docker-registry: stores container registry credentials.
TLS: stores certificate and key.
Secrets are base64 encoded.
Pods mount or reference secrets for secure access.

Full Transcript

This visual execution shows how Kubernetes manages three secret types: opaque, docker-registry, and TLS. First, secrets are created using kubectl commands with specific flags for each type. The secret data is stored encoded in base64 inside Kubernetes. Pods can then reference these secrets to access sensitive information like passwords, certificates, or registry credentials. The execution table traces each step from creation to pod usage, showing how secrets change state and how pods consume them securely. Key moments clarify why data is base64 encoded, the difference between opaque and TLS secrets, and how docker-registry secrets enable private image pulls. The quiz tests understanding of secret types, pod usage, and data changes.