Kubernetes Secret Explained

What is a Secret

A Secret is an object in Kubernetes used to store and manage sensitive information, such as passwords, OAuth tokens, SSH keys, etc. Unlike ConfigMap, Secret is specifically designed for handling confidential data and provides additional security protections.

Main Features of Secret

1. Security

Base64 Encoding: Data is stored in Base64 encoding (note: this is not encryption)
In-memory Storage: Stored as tmpfs on nodes, not written to disk
Access Control: Access is controlled via RBAC
Static Encryption: Supports static data encryption in etcd

2. Size Limit

Maximum size of a single Secret is 1MB
It is recommended to keep Secrets small for better performance

3. Scope

Namespace-scoped resource
Can only be used by Pods in the same namespace

Types of Secret

1. Opaque (Generic Secret)

The most common Secret type, used to store arbitrary user-defined data.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=     # base64 encoding of 'admin'
  password: MWYyZDFlMmU2N2Rm  # base64 encoding of '1f2d1e2e67df'

You can encode using Linux base64 command:

bash

echo -n "admin" | base64
echo -n "1f2d1e2e67df" | base64

2. kubernetes.io/service-account-token

Used for ServiceAccount authentication tokens.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: sa-token
  annotations:
    kubernetes.io/service-account.name: my-service-account
type: kubernetes.io/service-account-token
data:
  token: <base64-encoded-token>
  ca.crt: <base64-encoded-ca-certificate>

3. kubernetes.io/dockercfg and kubernetes.io/dockerconfigjson

Used to store Docker registry credentials.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: docker-secret
type: kubernetes.io/dockercfg
data:
  .dockercfg: <base64-encoded-dockercfg>

apiVersion: v1
kind: Secret
metadata:
  name: docker-secret
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base64-encoded-docker-config>

4. kubernetes.io/basic-auth

Used for basic authentication.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: basic-auth-secret
type: kubernetes.io/basic-auth
data:
  username: YWRtaW4=
  password: dGVzdA==

5. kubernetes.io/ssh-auth

Used for SSH authentication.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: ssh-secret
type: kubernetes.io/ssh-auth
data:
  ssh-privatekey: <base64-encoded-ssh-private-key>

6. kubernetes.io/tls

Used to store TLS certificates and private keys.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-certificate>
  tls.key: <base64-encoded-private-key>

7. bootstrap.kubernetes.io/token

Used for tokens during node bootstrap process.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: bootstrap-token
type: bootstrap.kubernetes.io/token
data:
  token-id: <base64-encoded-token-id>
  token-secret: <base64-encoded-token-secret>

Ways to Create a Secret

1. Create via Command Line

Create a generic Secret

bash

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=123456

Create from files

bash

kubectl create secret generic my-secret --from-file=username.txt --from-file=password.txt

Create Docker registry Secret

bash

kubectl create secret docker-registry my-registry-secret \
  --docker-server=myregistry.com \
  --docker-username=admin \
  --docker-password=mypassword \
  --docker-email=admin@example.com

Create TLS Secret

bash

kubectl create secret tls my-tls-secret --cert=path/to/cert.crt --key=path/to/key.key

2. Create via YAML file

yaml

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
  namespace: default
type: Opaque
data:
  database_url: cG9zdGdyZXNxbDovL3VzZXI6cGFzc3dvcmRAaG9zdDpwb3J0L2RiX25hbWU=
  api_key: bXktc2VjcmV0LWFwaS1rZXk=
stringData:  # Use stringData to provide plaintext, system will encode automatically
  debug_mode: "true"
  log_level: "info"

Using Secret in Pods

1. As Environment Variables

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: myapp
    image: nginx
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: app-secret
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: app-secret
          key: password
  restartPolicy: Never

2. Import All as Environment Variables

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-envfrom-pod
spec:
  containers:
  - name: myapp
    image: nginx
    envFrom:
    - secretRef:
        name: app-secret
  restartPolicy: Never

3. As Mounted Volumes

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-volume-pod
spec:
  containers:
  - name: myapp
    image: nginx
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: app-secret
  restartPolicy: Never

4. Specify Specific Files and Permissions

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-volume-specific
spec:
  containers:
  - name: myapp
    image: nginx
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: app-secret
      defaultMode: 0400  # read-only permission
      items:
      - key: username
        path: db-username
        mode: 0444
      - key: password
        path: db-password
        mode: 0400
  restartPolicy: Never

Secret Management Commands

View Secrets

bash

kubectl get secrets

kubectl describe secret my-secret

kubectl get secret my-secret -o yaml

kubectl get secret my-secret -o jsonpath='{.data.username}' | base64 -d

Update Secret

bash

kubectl edit secret my-secret

kubectl patch secret my-secret -p='{"data":{"password":"bmV3LXBhc3N3b3Jk"}}'

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=newpass --dry-run=client -o yaml | kubectl apply -f -

Delete Secret

bash

kubectl delete secret my-secret

Secret vs ConfigMap

Feature	Secret	ConfigMap
Purpose	Sensitive data	Non-sensitive config
Storage	Base64 encoded	Plaintext
Node Storage	tmpfs (memory)	Regular file system
Size Limit	1MB	1MB
Security	High (supports encryption)	General
Access Control	Strict RBAC	Relatively loose

Summary

Secret is the core mechanism in Kubernetes for handling sensitive data, providing multiple types to meet different use cases. Using Secret correctly can improve application security, but you should be aware of its limitations and best practices—especially enabling proper access control and encryption in production environments.

技术博客 | Go & Kubernetes & Linux

What is a Secret ​

Main Features of Secret ​

1. Security ​

2. Size Limit ​

3. Scope ​

Types of Secret ​

1. Opaque (Generic Secret) ​

2. kubernetes.io/service-account-token ​

3. kubernetes.io/dockercfg and kubernetes.io/dockerconfigjson ​

4. kubernetes.io/basic-auth ​

5. kubernetes.io/ssh-auth ​

6. kubernetes.io/tls ​

7. bootstrap.kubernetes.io/token ​

Ways to Create a Secret ​

1. Create via Command Line ​

Create a generic Secret ​

Create from files ​

Create Docker registry Secret ​

Create TLS Secret ​

2. Create via YAML file ​

Using Secret in Pods ​

1. As Environment Variables ​

2. Import All as Environment Variables ​

3. As Mounted Volumes ​

4. Specify Specific Files and Permissions ​

Secret Management Commands ​

View Secrets ​

Update Secret ​

Delete Secret ​

Secret vs ConfigMap ​

Summary ​

What is a Secret

Main Features of Secret

1. Security

2. Size Limit

3. Scope

Types of Secret

1. Opaque (Generic Secret)

2. kubernetes.io/service-account-token

3. kubernetes.io/dockercfg and kubernetes.io/dockerconfigjson

4. kubernetes.io/basic-auth

5. kubernetes.io/ssh-auth

6. kubernetes.io/tls

7. bootstrap.kubernetes.io/token

Ways to Create a Secret

1. Create via Command Line

Create a generic Secret

Create from files

Create Docker registry Secret

Create TLS Secret

2. Create via YAML file

Using Secret in Pods

1. As Environment Variables

2. Import All as Environment Variables

3. As Mounted Volumes

4. Specify Specific Files and Permissions

Secret Management Commands

View Secrets

Update Secret

Delete Secret

Secret vs ConfigMap

Summary