CKAD — Secrets

Secrets

Secrets store sensitive data like passwords, tokens, and certificates. They are similar to ConfigMaps but with important differences:

• Values are base64 encoded (not encrypted by default)
• Can be encrypted at rest with EncryptionConfiguration
• Have tighter RBAC controls

Creating Secrets

From Literals

kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password=s3cureP@ss!

From Files

# Create credential files
echo -n "admin" > username.txt
echo -n "s3cureP@ss!" > password.txt

kubectl create secret generic db-credentials \
  --from-file=username=username.txt \
  --from-file=password=password.txt

Declarative (YAML)

Values must be base64 encoded:

# Encode values
echo -n "admin" | base64        # YWRtaW4=
echo -n "s3cureP@ss!" | base64  # czNjdXJlUEBzcyE=

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=
  password: czNjdXJlUEBzcyE=

Or use stringData (Kubernetes encodes it for you):

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:
  username: admin
  password: "s3cureP@ss!"

Secret Types

Type	Description
Opaque	Default type for arbitrary data
kubernetes.io/dockerconfigjson	Docker registry credentials
kubernetes.io/tls	TLS certificate and key
kubernetes.io/basic-auth	Basic authentication
kubernetes.io/ssh-auth	SSH authentication

# Docker registry secret
kubectl create secret docker-registry my-reg \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass

# TLS secret
kubectl create secret tls my-tls \
  --cert=tls.crt \
  --key=tls.key

Viewing Secrets

# List secrets
kubectl get secrets

# View secret metadata (values are hidden)
kubectl describe secret db-credentials

# View encoded values
kubectl get secret db-credentials -o yaml

# Decode a specific value
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d
# Expected: s3cureP@ss!

---

Next: Using Secrets →