Secrets: Creation, Consumption and Encoding
A Secret is a ConfigMap with a different name, a type field, and one genuine difference: mounted Secrets land on tmpfs rather than disk. It is not encrypted, it is base64-encoded, and one command turns that back into plaintext. Knowing exactly what protection you do and do not get is the whole of this guide, along with the two consumption styles and their different leak profiles.
Configuration and Security Guide 25 of 44 Beginner
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 15 min
- Reviewed23 August 2026
Written against the versions above. Base64 is an encoding for binary-safe transport, not a security measure. Secrets can be encrypted at rest with an EncryptionConfiguration on the API server - a cluster-admin task, and CKA/CKS material rather than CKAD. What CKAD expects you to know is that without it, anyone with `get secret` in the namespace has the plaintext.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A cluster and kubectl.
- The session creates namespace
ckad-sec, anOpaqueSecret and akubernetes.io/dockerconfigjsonSecret, and two Pods consuming them.
-
Create one, and read it straight back
-
Two ways into a container
-
The env var spreads further than you think
-
The typed Secrets