Managing Secrets

1. Creating Generic Secret

Field	Description	Example
apiVersion	API version to use	`v1`
kind	Kind of the resource	`Secret`
metadata.name	Name of the secret	`my-secret`
type	Type of secret (optional)	`Opaque`
data	Base64 encoded key-value pairs	`{ "password": "cGFzc3dvcmQ=" }`

Example: Creating a Generic Secret from Literal Values

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

Example: Creating a Secret from Environment File

kubectl create secret generic my-secret \
  --from-env-file=env.txt

Note: The data field requires base64-encoded values. Use echo -n 'value' | base64 to encode.

2. Creating TLS Secret

Field	Description	Example Value
apiVersion	API version to use for the secret resource	`v1`
kind	Type of Kubernetes resource	`Secret`
metadata.name	Name of the secret object	`tls-secret`
type	Secret type indicating it holds TLS data	`kubernetes.io/tls`
data.tls.crt	Base64 encoded certificate content	`LS0tLS1CRUdJTiBDRVJ...==`
data.tls.key	Base64 encoded private key content	`LS0tLS1CRUdJTiBQUklW...==`

Example: Create TLS Secret from Files

kubectl create secret tls my-tls-secret \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key

Example: Create TLS Secret from Literal Values

kubectl create secret tls my-tls-secret \
  --cert=cert.pem \
  --key=key.pem

3. Creating Docker Registry Secret

Field	Description	Example Value
apiVersion	API version to use for the secret	`v1`
kind	Type of Kubernetes object	`Secret`
metadata.name	Name of the secret	`my-docker-registry-secret`
type	Type of secret (must be `kubernetes.io/dockerconfigjson` for Docker registry secrets)	`kubernetes.io/dockerconfigjson`
data	Base64-encoded JSON configuration for Docker registry access	`eyJhdXRocyI6e30sInN0YXR1cyI6ImZhaWxlZCJ9`

Example: Creating a Docker Registry Secret from .docker/config.json

docker login registry.example.com -u username -p password
kubectl create secret generic my-docker-registry-secret \
  --from-file=.docker/config.json

Note: The .docker/config.json file must contain valid Docker registry credentials in the correct format.

Warning: Ensure that the secret is stored securely and not exposed in logs or command-line arguments.

4. Encoding Secret Data

Encoding Method	Description	Usage Example	Notes
Base64	Standard encoding for secret data in Kubernetes	`echo -n "my-secret" \| base64`	Used for encoding secret values in secret manifests
Hexadecimal	Alternative encoding for binary or hex data	`echo -n "binary-data" \| xxd -p`	Not commonly used for secrets, but valid

Example: Encoding a Secret Value

echo -n "my-password" | base64

echo -n "my-password" | base64
# Output: bXktcGFzc3dvcmQ=

Note: Kubernetes does not store secrets in plaintext. All secret data must be base64-encoded before being stored in a Secret resource.

5. Listing Secrets

Command	Description	Notes
kubectl get secrets	List all secrets in the current namespace	Default output includes secret name and type
kubectl get secrets -A	List all secrets across all namespaces	Useful for cluster-wide secret inventory
kubectl get secrets --sort-by=.metadata.creationTimestamp	List secrets sorted by creation timestamp	Helps identify newly created secrets

Example: Listing Secrets in a Namespace

kubectl get secrets -n production
NAME                    TYPE     DATA   AGE
db-credentials          Opaque   2      10d
api-key                 Opaque   1      5d

Note: By default, kubectl get secrets does not show secret data. Use kubectl describe secret <secret-name> to view details.

6. Describing Secret Details

Field	Description	Example Value
apiVersion	API version of the Secret resource	`v1`
kind	Type of the Kubernetes resource	`Secret`
metadata.name	Name of the Secret	`my-secret`
metadata.namespace	Namespace where the Secret is stored	`default`
type	Type of the Secret (e.g., `Opaque`, `kubernetes.io/tls`)	`Opaque`
data	Base64-encoded secret values	`{ "password": "cGFzc3dvcmQ=" }`

Example: Describe Secret Details

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  namespace: default
type: Opaque
data:
  password: cGFzc3dvcmQ=

Note: The data field contains base64-encoded values. You can use kubectl get secret <secret-name> -o yaml to view the decoded content.

7. Using Secrets as Environment Variables

Property	Description	Example
envFrom	Reference to a Secret object to inject all key-value pairs as environment variables	`envFrom: - secretRef: name: my-secret`
env	Define specific environment variables with values from a Secret	`env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: my-secret key: password`

Example: Injecting All Secret Values as Environment Variables

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: myapp-container
    image: nginx
    envFrom:
    - secretRef:
        name: db-secret
  restartPolicy: Never

Example: Using Specific Secret Key as Environment Variable

apiVersion: v1
kind: Pod
metadata:
  name: secret-key-env-pod
spec:
  containers:
  - name: myapp-container
    image: nginx
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password
  restartPolicy: Never

Note: Environment variables are injected at container startup and cannot be updated without restarting the pod.

8. Mounting Secrets as Volumes

Field	Description	Example
secretName	Name of the Secret object to mount	`my-secret`
items	Map of secret keys to file paths	`[{key: "password", path: "db-password"}]`
defaultMode	Permissions for mounted files (octal)	`0644`

Example: Mounting a Secret as a Volume

apiVersion: v1
kind: Pod
metadata:
  name: secret-pod
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secret
  volumes:
  - name: secret-volume
    secret:
      secretName: my-secret

Note: Changes to the Secret object are automatically propagated to mounted volumes.

Warning: Secret data is base64-encoded in etcd, but not encrypted. Use secrets with caution.

9. Using imagePullSecrets

Property	Description	Example
imagePullSecrets	Array of secret names to use for pulling images from private registries	`[{ name: 'my-registry-secret' }]`

Example: Define imagePullSecrets in a Pod

apiVersion: v1
kind: Pod
metadata:
  name: private-image-pod
spec:
  imagePullSecrets:
    - name: my-registry-secret
  containers:
    - name: app-container
      image: private-registry.example.com/my-app:latest

Example: Define imagePullSecrets in a Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      imagePullSecrets:
        - name: my-registry-secret
      containers:
        - name: app-container
          image: private-registry.example.com/my-app:latest

Note: The secret must be of type kubernetes.io/dockerconfigjson or kubernetes.io/ssh-auth.

Warning: Ensure that the secret is created in the same namespace as the Pod or Deployment.

10. Updating Secrets

Field	Description	Notes
metadata.name	Name of the secret	Must be unique within the namespace
data	Key-value pairs of secret data	Values must be base64-encoded
stringData	Key-value pairs of secret data (plain text)	Automatically base64-encoded by Kubernetes

Example: Updating a Secret with kubectl

kubectl patch secret my-secret -p '{"data":{"key1":"newvalue1"}}

Example: Updating a Secret with kubectl edit

kubectl edit secret my-secret

Note: Changes to secrets are not automatically propagated to pods. Pods must be restarted or recreated to pick up new secret values.

11. Understanding Secret Types

Type	Description	Use Case	Example
Opaque	Generic secret containing arbitrary data	Storing passwords, tokens, or configuration values	`apiVersion: v1 kind: Secret metadata: name: db-secret type: Opaque data: password: cGFzc3dvcmQ=`
TLS	Secret containing TLS certificate and key	Enabling HTTPS in services or Ingress	`apiVersion: v1 kind: Secret metadata: name: tls-secret type: kubernetes.io/tls data: tls.crt: LS0tLS1CRUdJTiBDRVJ... tls.key: LS0tLS1CRUdJTiBSU0E...`
BootstrapToken	Used for bootstrapping nodes in a cluster	Joining new nodes to the cluster securely	`apiVersion: v1 kind: Secret metadata: name: bootstrap-token-123456 type: bootstrap.kubernetes.io/token data: token-id: c29tZS10b2tlbg== token-secret: c29tZS1zZWNyZXQ=`
ServiceAccountToken	Automatically generated for service accounts	Allowing pods to access the API server	`apiVersion: v1 kind: Secret metadata: name: default-token-abcde type: kubernetes.io/service-account-token data: ca.crt: LS0tLS1CRUdJTiBDRVJ... namespace: ZGVmYXVsdA== token: c29tZS10b2tlbi10aGlzLXN0cmluZw==`
DockerConfigJson	Stores Docker registry credentials	Accessing private container registries	`apiVersion: v1 kind: Secret metadata: name: registry-secret type: kubernetes.io/dockerconfigjson data: .dockerconfigjson: eyJhdXRoIjog...`

12. Deleting Secrets

Field	Description	Values
name	Name of the secret to delete	`my-secret`
namespace	Namespace where the secret is stored	`default`
cascade	Specifies whether to delete dependent objects	`background`, `foreground`, `orphan`

Example: Delete a Secret

kubectl delete secret my-secret -n default

Example: Delete a Secret with Cascading

kubectl delete secret my-secret --cascade=orphan -n default

Note: Deleting a secret does not immediately remove it from the etcd store. It is marked for deletion and cleaned up by the garbage collector.