Secret YAML
- Docker & Kubernetes course
- Intermediate
- Lesson 51/82
- 4 min
Learn the Secret YAML structure.
Secret YAML
In a Secret YAML, values are written as base64 under data. Encoding by hand is error-prone; the stringData field accepts plain text and Kubernetes converts it to base64 when saving:
apiVersion: v1
kind: Secret
metadata:
name: db-gizli
type: Opaque
stringData:
DB_USER: app
DB_PASSWORD: gizli123Warning: echo "gizli" | base64 appends a newline at the end; the right way is echo -n "gizli" | base64.
data and stringData
If the same key is in both fields, stringData wins. In the saved object only data ever appears:
$ echo -n gizli123 | base64
Z2l6bGkxMjM=
# data form
data:
DB_PASSWORD: Z2l6bGkxMjM=
# stringData form
stringData:
DB_PASSWORD: gizli123Practice Write the Secret YAML
Write a Secret YAML: name db-gizli, type: Opaque; DB_USER: app and DB_PASSWORD: gizli123 under stringData.
Starter code
# buraya yazSample solution
apiVersion: v1
kind: Secret
metadata:
name: db-gizli
type: Opaque
stringData:
DB_USER: app
DB_PASSWORD: gizli123Expected output
secret/db-gizli created
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Why can a password encoded with echo "gizli" | base64 cause a connection error?
- A newline character is added to the end of the value Correct answer
- base64 doesn't support Turkish characters
- The value is encrypted
- The value is shortened
Explanation: echo -n doesn't add the newline.
2 Write the field that takes plain-text values.
Question
type: Opaque
____:
DB_PASSWORD: gizli123
Answer
type: Opaque
stringData:
DB_PASSWORD: gizli123Explanation: stringData is converted to base64 when saved.
3 Match.
| Term | Meaning |
|---|---|
data |
base64 values |
stringData |
Plain-text values |
echo -n |
No trailing newline |
type: Opaque |
Generic Secret |