Managing Secrets
1. Creating Generic Secret
kubectl create secret generic db \
--from-literal=username=app \
--from-literal=password='S3cr3t!'
| Source | Flag |
|---|
| Literal | --from-literal=K=V |
| File | --from-file=key=path |
| Env file | --from-env-file=.env |
2. Creating TLS Secret
kubectl create secret tls www-tls \
--cert=server.crt --key=server.key
| Key | Content |
|---|
| tls.crt | PEM-encoded cert (and chain) |
| tls.key | PEM-encoded private key |
3. Creating Docker Registry Secret
kubectl create secret docker-registry ghcr \
--docker-server=ghcr.io \
--docker-username=USER \
--docker-password=TOKEN \
--docker-email=u@x.com
spec:
imagePullSecrets:
- { name: ghcr }
4. Encoding Secret Data
echo -n 'S3cr3t!' | base64 # encode
echo 'UzNjcjN0IQ==' | base64 -d # decode
| Field | Format |
|---|
| data | Base64-encoded |
| stringData | Plain text (encoded by apiserver) |
5. Listing Secrets
kubectl get secrets
kubectl get secret db -o jsonpath='{.data.password}' | base64 -d
| Column | Meaning |
|---|
| TYPE | Opaque, kubernetes.io/tls, etc. |
| DATA | Number of keys |
6. Describing Secret Details
Note: describe hides values; use get -o yaml with appropriate RBAC for inspection.
| Action | RBAC verb |
|---|
| List names | list on secrets |
| Read values | get on secrets (restrict!) |
7. Using Secrets as Environment Variables
env:
- name: DB_PASS
valueFrom: { secretKeyRef: { name: db, key: password } }
envFrom:
- secretRef: { name: app-secrets }
Warning: Secrets in env may leak via process listings or logs. Prefer file mounts when feasible.
8. Mounting Secrets as Volumes
volumes:
- name: tls
secret:
secretName: www-tls
defaultMode: 0400
volumeMounts:
- { name: tls, mountPath: /etc/tls, readOnly: true }
| Behavior | Detail |
|---|
| tmpfs | Stored in RAM (no disk) |
| Auto-update | ~minute sync (no env) |
9. Using imagePullSecrets
apiVersion: v1
kind: ServiceAccount
metadata: { name: default }
imagePullSecrets:
- { name: ghcr }
| Where | Scope |
|---|
| Pod spec | Per-pod |
| ServiceAccount | All pods using that SA |
10. Updating Secrets
kubectl create secret generic db \
--from-literal=password='NewP@ss' \
--dry-run=client -o yaml | kubectl apply -f -
kubectl rollout restart deploy/web
| Strategy | Effect |
|---|
| Volume mount | Auto-updates (~minute) |
| Env var | Requires pod restart |
| Stakater Reloader | Auto rollout on Secret/CM change |
11. Understanding Secret Types
| Type | Use |
|---|
| Opaque | Generic (default) |
| kubernetes.io/tls | TLS cert/key |
| kubernetes.io/dockerconfigjson | Registry auth |
| kubernetes.io/basic-auth | username/password |
| kubernetes.io/ssh-auth | SSH private key |
| kubernetes.io/service-account-token | SA token (mostly auto) |
| bootstrap.kubernetes.io/token | Bootstrap tokens |
12. Deleting Secrets
kubectl delete secret db
kubectl delete secret -l env=dev
Warning: Enable encryption-at-rest (EncryptionConfiguration with AES-CBC/KMS) for true secret protection in etcd.