Skip to main content
Mapagam

Working with Secrets and Sensitive Data

1. Creating Secret Templates

Field Description Example
apiVersion API version for Secret resource v1
kind Resource type Secret
metadata.name Name of the secret my-secret
type Secret type (e.g., Opaque, kubernetes.io/tls) Opaque

Example: Basic Secret Template

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  username: "YWRtaW4="
  password: "cGFzc3dvcmQ="

2. Encoding Secret Values

Encoding Method Description Example
Base64 Standard encoding for secret values echo -n "admin" | base64
String Data Allows direct string input (auto-encodes to base64) stringData: {username: admin}

Example: Using StringData

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
stringData:
  username: admin
  password: secret123

3. Using External Secrets

Field Description Example
externalSecret.name Name of the external secret resource my-external-secret
externalSecret.data Mapping of secret keys to external sources data: {username: "aws-secrets/username"}

Example: External Secret Definition

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  secretStoreRef:
    name: aws-secret-store
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: username
    remoteRef:
      key: aws-secrets/username

4. Integrating with HashiCorp Vault

Field Description Example
vault.path Path to secret in Vault /secret/data/myapp
vault.role Role for Vault authentication helm-role

Example: Vault Secret Store

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-store
spec:
  provider:
    vault:
      server: https://vault.example.com
      path: secret/data/myapp
      role: helm-role

5. Using SOPS for Encryption

Field Description Example
sops.encrypted Indicates encrypted secret true
sops.age Age key for encryption age1...

Example: SOPS Encrypted Secret

apiVersion: v1
kind: Secret
metadata:
  name: sops-secret
type: Opaque
data:
  username: ENC[AES256_GCM,data=...]
  password: ENC[AES256_GCM,data=...]

6. Managing TLS Certificates

Field Description Example
tls.crt Base64 encoded certificate LS0tL...==
tls.key Base64 encoded private key LS0tL...==

Example: TLS Secret

apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
type: kubernetes.io/tls
data:
  tls.crt: "LS0tL...=="
  tls.key: "LS0tL...=="

7. Using Sealed Secrets

Field Description Example
sealedSecrets.name Name of sealed secret resource my-sealed-secret
sealedSecrets.encryptedData Encrypted secret data data: ENC[...]

Example: Sealed Secret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: my-sealed-secret
spec:
  encryptedData:
    username: ENC[...]
    password: ENC[...]

8. Passing Secrets via Values

Field Description Example
values.secrets Secrets passed to chart secrets: {username: admin}
values.secretName Name of secret in chart secretName: my-secret

Example: Chart Values with Secrets

secrets:
  username: admin
  password: secret123

9. Using Secret Files

Field Description Example
secretFiles Files mounted as secrets secretFiles: {config.yaml: /path/to/config}
mountPath Mount path in container /etc/config

Example: Secret File Mount

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
    - name: app
      image: my-app
      volumeMounts:
        - name: config-volume
          mountPath: /etc/config
  volumes:
    - name: config-volume
      secret:
        secretName: my-secret

10. Avoiding Hardcoded Secrets

Approach Description Best Practice
Environment Variables Use environment variables for sensitive data envFrom: secretRef
External Secret Stores Use external secret stores like Vault or AWS Secrets Manager external-secrets.io
Note: Never hardcode secrets in chart templates or values files.

Was this article helpful?

Related Cheat Sheets