Summary - Secret

Combine YAML and mount to use sensitive data safely.

Summary: Secrets

In this group:

A Secret holds secret data; values are base64, not encrypted. They aren't put in Git and are protected with RBAC and etcd encryption.
Types: Opaque, kubernetes.io/tls, dockerconfigjson (imagePullSecrets).
In YAML, stringData accepts plain text; echo -n prevents the trailing newline.
Usage: secretKeyRef/secretRef or a secret.secretName volume (defaultMode).
Rotation: --dry-run=client -o yaml | kubectl apply -f - and rollout restart.

kubectl create secret generic db-gizli --from-file=DB_PASSWORD=./parola.txt
kubectl get secret db-gizli -o jsonpath='{.data.DB_PASSWORD}' | base64 -d

Exercise Mount the TLS secret

Write a pod's spec section (starting with spec:): a tls volume from the web-tls Secret with defaultMode: 0400 under volumes; container named nginx, image nginx:1.27; mount tls at /etc/tls with readOnly: true.

Show example solution

spec:
  volumes:
    - name: tls
      secret:
        secretName: web-tls
        defaultMode: 0400
  containers:
    - name: nginx
      image: nginx:1.27
      volumeMounts:
        - name: tls
          mountPath: /etc/tls
          readOnly: true

Test yourself

Which is used to keep a Secret YAML safely in a Git repository?
- Writing type: Opaque
- A tool like Sealed Secrets or External Secrets
- Encoding with base64 once more
- Using stringData
Show answer

A tool like Sealed Secrets or External Secrets — Sealed Secrets produces an encrypted object that only the cluster can decrypt.

Mount the Secret as a volume.

      volumes:
        - name: tls
          secret:
            ____: web-tls

Show answer

      volumes:
        - name: tls
          secret:
            secretName: web-tls

Match.

Secret

Secret
ConfigMap

Not secret
base64 -d

Decode the value
imagePullSecrets

Private registry

Next lesson: What is a Namespace?

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies