Secrets are not encrypted by default in Kubernetes - Mini Project: Build & Apply

Understanding Kubernetes Secrets Are Not Encrypted by Default

📖 Scenario: You are working with Kubernetes to manage sensitive data like passwords and API keys. You want to see how Kubernetes stores secrets by default and understand why they are not encrypted automatically.

🎯 Goal: Learn how to create a Kubernetes Secret, check its stored data in plain text, and understand that Kubernetes does not encrypt secrets by default.

📋 What You'll Learn

Create a Kubernetes Secret with exact name and data

Use kubectl commands to view the Secret

Understand the default storage format of Secrets

💡 Why This Matters

🌍 Real World

Kubernetes Secrets store sensitive data like passwords and tokens needed by applications running in clusters.

💼 Career

Understanding how Kubernetes stores secrets helps DevOps engineers secure sensitive information and comply with security best practices.

1

Create a Kubernetes Secret

Create a Kubernetes Secret named mysecret in the default namespace with the key username and value admin using the kubectl command.

Kubernetes

# Your kubectl command here to create the secret

Need a hint?

Use kubectl create secret generic with --from-literal to add the key and value.

2

Check the Secret Data in Plain Text

Use the command kubectl get secret mysecret -o yaml to display the secret details including the encoded data.

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin
# Your command here to get the secret in yaml format

Need a hint?

This command shows the secret data encoded in base64, not encrypted.

3

Decode the Secret Data to See Plain Text

Use the command kubectl get secret mysecret -o jsonpath='{.data.username}' | base64 --decode to decode and display the secret value in plain text.

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin
kubectl get secret mysecret -o yaml
# Your command here to decode the username value

Need a hint?

Use jsonpath to extract the encoded value and base64 --decode to see the original text.

4

Display the Decoded Secret Value

Run the command to decode and print the secret value. The output should be admin.

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin
kubectl get secret mysecret -o yaml
kubectl get secret mysecret -o jsonpath='{.data.username}' | base64 --decode
# Run the command to see the output

Need a hint?

The decoded output shows the secret value stored in plain text (base64 encoded but not encrypted).