What is a Secret?
- Docker & Kubernetes course
- Intermediate
- Lesson 49/82
- 4 min
Learn to manage sensitive data with Secrets.
What is a Secret?
A Secret is an object holding secret data such as passwords, API keys and TLS certificates. Its use is very similar to a ConfigMap; the difference is that Kubernetes restricts access to Secrets with separate permissions, keeps them on nodes only in memory (tmpfs), and they can be encrypted in etcd.
kubectl create secret generic db-gizli --from-literal=DB_PASSWORD=S3cr3t!
kubectl get secret db-gizli
# NAME TYPE DATA AGE
# db-gizli Opaque 1 3sbase64 is not a cipher
The values in a Secret YAML are base64 and anyone can decode them. That is why Secret YAMLs aren't put in Git; access is limited with RBAC; if needed, Sealed Secrets, External Secrets or a vault (Vault) are used:
$ kubectl get secret db-gizli -o jsonpath='{.data.DB_PASSWORD}'
UzNjcjN0IQ==
$ echo UzNjcjN0IQ== | base64 -d
S3cr3t!Practice Create and read a Secret
Write two commands: create a generic Secret named db-gizli with the value DB_PASSWORD=gizli123; then take the value with jsonpath and decode it by piping into base64 -d.
Starter code
# buraya yazSample solution
kubectl create secret generic db-gizli --from-literal=DB_PASSWORD=gizli123
kubectl get secret db-gizli -o jsonpath='{.data.DB_PASSWORD}' | base64 -dExpected output
secret/db-gizli created gizli123
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 How are the values in a Secret stored by default?
- Hashed
- Plain text, unencoded
- base64-encoded; not encrypted Correct answer
- Encrypted with AES
Explanation: base64 isn't encryption; etcd encryption must be enabled separately.
2 Decode the base64 value.
echo UzNjcjN0IQ== | base64 ____echo UzNjcjN0IQ== | base64 -dExplanation: -d (decode) decodes.
3 Match.
| Term | Meaning |
|---|---|
Secret |
Secret data |
base64 |
Encoding, not a cipher |
tmpfs |
Only in memory on the node |
Sealed Secrets |
Putting safely in Git |