Understanding Kubernetes: Part 9 -Kubernetes Secret

If you’ve been following our Kubernetes series 2025, welcome back! For new readers, check out Part 8: Understanding Kubernetes: ConfigMap

What is a Kubernetes Secret?

A Kubernetes Secret is an object used to store sensitive information, such as passwords, OAuth tokens, SSH keys, or certificates. It helps manage confidential data securely by avoiding hardcoding sensitive values in application code or configuration files. Secrets are stored in base64-encoded format and can be accessed by pods and applications in a secure way.

For example:

If your application requires a database password or an API key to access a third-party service, you can store these sensitive values in a Kubernetes Secret. The secret can then be mounted as environment variables or volumes, ensuring that sensitive data is handled securely, without exposing it in plaintext.

Kubernetes Secret Capabilities:

• Secure Storage: Stores sensitive data in an encrypted format within the Kubernetes cluster.

• Access Control: Can be restricted with RBAC (Role-Based Access Control) to limit access to authorized users and services.

• Multiple Usage: Can be injected as environment variables, volumes, or as part of a service account for pod authentication.

• Base64 Encoding: While secrets are base64-encoded, it’s important to note that base64 is not encryption, so you should consider using encryption at rest for enhanced security.

In my previous role:

As a Senior DevOps Engineer, I used Kubernetes Secrets to securely manage API keys and database credentials for microservices. For example, we stored sensitive credentials for a PostgreSQL database in a Secret and injected it into application containers as environment variables. This approach kept sensitive information secure while enabling easy access for applications. We also implemented RBAC policies to ensure only authorized services could access the secrets, adding an extra layer of security.

Here’s a simple YAML for a Kubernetes Secret:

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  DB_USERNAME: cG93ZXI=        # 'power' in base64 encoding
  DB_PASSWORD: c2VjdXJlX2p3b3A=  # 'secure_jwop' in base64 encoding

This Secret contains the database username (power) and password (secure_jwop) encoded in base64. These values can be accessed by pods by mounting the Secret as environment variables, ensuring that sensitive data is securely managed within the cluster. Kubernetes Secrets provide an essential mechanism for handling sensitive information in a secure and scalable way.

🚀 Ready to Master Kubernetes?

Take your Kubernetes journey to the next level with the Master Kubernetes: Zero to Hero course! 🌟 Whether you’re a beginner or aiming to sharpen your skills, this hands-on course covers:

✅ Kubernetes Basics — Grasp essential concepts like nodes, pods, and services. ✅ Advanced Scaling — Learn HPA, VPA, and resource optimization. ✅ Monitoring Tools — Master Prometheus, Grafana, and AlertManager. ✅ Real-World Scenarios — Build production-ready Kubernetes setups.

🎓 What You’ll Achieve

💡 Confidently deploy and manage Kubernetes clusters. 🛡️ Secure applications with ConfigMaps and Secrets. 📈 Optimize and monitor resources for peak performance.

🔥 Start Learning Now: [Join the Master Kubernetes Course](https://cloudops0.gumroad.com/l/k8s)

Don’t miss your chance to become a Kubernetes expert! 💻✨

🚀 Stay ahead in DevOps and SRE! 🔔 Subscribe now and never miss a beat on Kubernetes and more. 🌟