Kubernetes Secret: What It Is and How It Works

A Secret in Kubernetes is a special object used to store sensitive information like passwords, tokens, or keys securely. It keeps this data separate from application code and configuration, helping protect it from exposure.

How It Works

Think of a Kubernetes Secret as a locked box inside your cluster where you keep sensitive information safe. Instead of putting passwords or keys directly in your app's code or configuration files, you store them in this box. When your app needs the secret, Kubernetes hands it over securely.

This works by encoding the secret data (usually in base64) and storing it in the cluster's database. Only authorized parts of your app can access the secret, reducing the risk of accidental leaks. It’s like giving your app a key to open the box only when needed.

Example

This example creates a Kubernetes Secret that stores a username and password. The secret can then be used by pods to access these credentials securely.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  username: YWRtaW4=  # base64 for 'admin'
  password: MWYyZDFlMmU2N2Rm  # base64 for '1f2d1e2e67df'

Output

secret/my-secret created

When to Use

Use Kubernetes Secrets whenever you need to store sensitive data like passwords, API keys, or certificates that your applications require. This keeps secrets out of your code and configuration files, improving security.

For example, if your app connects to a database, store the database password in a Secret instead of hardcoding it. Also, use Secrets to manage TLS certificates or OAuth tokens safely within your cluster.

Key Points

• Secrets store sensitive data separately from app code.
• Data is base64 encoded, not encrypted by default.
• Access to Secrets is controlled by Kubernetes RBAC.
• Use Secrets to keep passwords, tokens, and keys secure.
• Pods can consume Secrets as environment variables or files.

Key Takeaways

Kubernetes Secrets securely store sensitive data like passwords and keys separate from app code.

Secrets data is base64 encoded and access is controlled by Kubernetes permissions.

Use Secrets to protect credentials and tokens your apps need to function.

Pods can access Secrets as environment variables or mounted files.

Storing secrets properly reduces risk of accidental exposure in your cluster.