Opaque Secret in Kubernetes: What It Is and How to Use

An Opaque secret in Kubernetes is a type of secret used to store arbitrary sensitive data such as passwords or tokens in a base64-encoded format. It is the default secret type and lets you securely pass confidential information to your applications without exposing it in plain text.

How It Works

Think of an Opaque secret as a locked box where you can store any kind of sensitive information you want to keep safe, like passwords or API keys. Kubernetes stores this data encoded in base64, which is like writing your secret message in a secret code that only Kubernetes understands.

When your application runs inside Kubernetes, it can ask for this locked box and use the secret data without ever showing it openly. This keeps your sensitive information hidden from people who shouldn't see it, much like how you keep your house keys in a safe place.

Example

This example shows how to create an Opaque secret with a username and password, then how to view its encoded content.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: my-opaque-secret
type: Opaque
data:
  username: YWRtaW4=  # base64 for 'admin'
  password: MWYyZDFlMmU2N2Rm  # base64 for '1f2d1e2e67df'

Output

secret/my-opaque-secret created

When to Use

Use Opaque secrets when you need to store any kind of sensitive data that does not fit into specialized secret types. For example, store database passwords, API tokens, or encryption keys.

This is useful in real-world cases like configuring your app to connect securely to a database without hardcoding passwords in your code or configuration files.

Key Points

• Opaque is the default secret type in Kubernetes.
• It stores data as base64-encoded key-value pairs.
• It can hold any arbitrary sensitive data.
• Applications access secrets securely via environment variables or mounted files.

Key Takeaways

Opaque secrets store arbitrary sensitive data securely in Kubernetes.

Data in opaque secrets is base64-encoded key-value pairs.

Use opaque secrets for passwords, tokens, and other confidential info.

Applications access opaque secrets via environment variables or files.

Opaque is the default and most flexible secret type in Kubernetes.