Secret types
- Docker & Kubernetes course
- Intermediate
- Lesson 50/82
- 4 min
Learn Opaque and docker-registry Secret types.
Secret types
A Secret's type field determines the content's format, and Kubernetes validates some types:
Opaque(generic): free key-value; the most common.kubernetes.io/tls:tls.crtandtls.key; for Ingress TLS.kubernetes.io/dockerconfigjson: for pulling images from a private registry.kubernetes.io/service-account-token: a ServiceAccount token.
kubectl create secret tls web-tls --cert=sertifika.crt --key=anahtar.key
kubectl create secret docker-registry ghcr-giris \
--docker-server=ghcr.io --docker-username=ali --docker-password="$GHCR_TOKEN"imagePullSecrets
The registry Secret is given in the pod spec with imagePullSecrets. It can also be added to the ServiceAccount for all pods in the same namespace:
spec:
imagePullSecrets:
- name: ghcr-giris
containers:
- name: api
image: ghcr.io/ali/api:1.0
kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"ghcr-giris"}]}'Practice Pull from a private registry
Write a pod YAML: name api; ghcr-giris under imagePullSecrets; container named api, image ghcr.io/ali/api:1.0.
Starter code
# buraya yazSample solution
apiVersion: v1
kind: Pod
metadata:
name: api
spec:
imagePullSecrets:
- name: ghcr-giris
containers:
- name: api
image: ghcr.io/ali/api:1.0Expected output
pod/api created NAME READY STATUS RESTARTS AGE api 1/1 Running 0 11s
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 With which field does a pod refer to a Secret to pull an image from a private registry?
- registrySecret
- imagePullSecrets Correct answer
- envFrom
- volumes
Explanation: The Secret must be of type kubernetes.io/dockerconfigjson.
2 Create a TLS-type Secret.
Question
kubectl create secret ____ web-tls --cert=sertifika.crt --key=anahtar.key
Answer
kubectl create secret tls web-tls --cert=sertifika.crt --key=anahtar.keyExplanation: The tls type creates the tls.crt and tls.key keys.
3 Match the types.
| Term | Meaning |
|---|---|
Opaque |
Free key-value |
kubernetes.io/tls |
Certificate and key |
dockerconfigjson |
Registry login |
service-account-token |
ServiceAccount token |