Using Secrets as environment variables in Kubernetes - Step-by-Step Execution

Process Flow - Using Secrets as environment variables

Create Secret

↓

Define Pod Spec

↓

Reference Secret in env

↓

Deploy Pod

↓

Pod Starts with Secret as env var

↓

Container uses Secret securely

This flow shows how a Kubernetes Secret is created, referenced in a Pod's environment variables, and then used securely by the container.

Execution Sample

Kubernetes

kubectl create secret generic mysecret --from-literal=PASSWORD=abc123

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: app
    image: busybox
    env:
    - name: PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysecret
          key: PASSWORD

This code creates a secret named 'mysecret' with a password, then defines a Pod that uses this secret as an environment variable.

Process Table

Step	Action	Resource Affected	Result
1	Create Secret 'mysecret' with key PASSWORD=abc123	Secret resource	Secret 'mysecret' created with PASSWORD key
2	Define Pod spec referencing secret in env var PASSWORD	Pod spec	Pod spec includes env var PASSWORD from secret 'mysecret'
3	Deploy Pod 'secret-env-pod'	Pod resource	Pod created and scheduled on node
4	Pod starts container 'app'	Container environment	Container env var PASSWORD set to secret value 'abc123'
5	Container runs and can access PASSWORD env var	Container runtime	Application can securely use PASSWORD from env
6	Pod terminates or deleted	Pod resource	Secret remains intact, Pod removed

💡 Pod lifecycle ends; secret remains stored securely in Kubernetes.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Secret 'mysecret'	Not created	Created with PASSWORD=abc123	No change	No change	No change	Exists in cluster
Pod spec	Not defined	No change	Defined with env var PASSWORD from secret	No change	No change	Defined
Pod status	Not created	No change	No change	Created and scheduled	Running with env var set	Terminated or running
Container env var PASSWORD	Unset	Unset	Unset	Set to 'abc123'	Accessible to container	Accessible until pod ends

Key Moments - 3 Insights

Why doesn't the secret value appear directly in the Pod spec?

Because the Pod spec references the secret by name and key (secretKeyRef), not by embedding the secret value. This keeps the secret secure and separate, as shown in execution_table step 2.

What happens if the secret is deleted while the Pod is running?

The Pod keeps the environment variable value it received at start. Deleting the secret does not affect running Pods immediately, as environment variables are set at container start (see execution_table step 4).

How does Kubernetes keep the secret value secure in environment variables?

Kubernetes stores secrets encrypted (depending on cluster setup) and injects them only into containers that reference them. The secret is not exposed in Pod specs or logs, only inside container environment at runtime (execution_table step 4).

Visual Quiz - 3 Questions

Look at the execution table, at which step is the Pod created and scheduled on a node?

A Step 2

B Step 3

C Step 4

D Step 1

💡 Hint

Check the 'Action' column for Pod creation and scheduling in the execution_table.

According to the variable tracker, when does the container environment variable PASSWORD get its secret value?

A After Step 2

B After Step 3

C After Step 4

D At Start

💡 Hint

Look at the 'Container env var PASSWORD' row in variable_tracker for when it changes from 'Unset' to the secret value.

If the secret 'mysecret' is deleted after the Pod starts, what happens to the PASSWORD env var inside the container?

A It becomes empty immediately

B It remains accessible until Pod restarts

C Pod crashes immediately

D Pod automatically recreates the secret

💡 Hint

Refer to key_moments explanation about secret deletion impact on running Pods.

Concept Snapshot

Create a Secret with kubectl create secret.
Reference it in Pod spec under env using secretKeyRef.
Deploy Pod; container gets secret as env var.
Secret value not visible in Pod spec.
Secret remains secure and separate from Pod lifecycle.

Full Transcript

This visual execution shows how to use Kubernetes Secrets as environment variables in Pods. First, a Secret named 'mysecret' is created with a key PASSWORD and value 'abc123'. Then, a Pod specification is defined that references this secret in its environment variables. When the Pod is deployed, Kubernetes injects the secret value into the container's environment variable PASSWORD. The secret value is not directly visible in the Pod spec, keeping it secure. The container can use the PASSWORD environment variable during runtime. Even if the secret is deleted later, the running Pod retains the environment variable value until it restarts or terminates.