Secrets: Creation, Consumption and Encoding

Configuration and Security / Guide 25 of 44 / Beginner

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 15 min

Base64 is an encoding for binary-safe transport, not a security measure. Secrets can be encrypted at rest with an EncryptionConfiguration on the API server - a cluster-admin task, and CKA/CKS material rather than CKAD. What CKAD expects you to know is that without it, anyone with get secret in the namespace has the plaintext.

This guide includes

Use this when credentials have to reach a container and you need to know what a Secret actually protects. This matters because base64 is transport encoding rather than security, and an environment variable spreads a credential considerably further than a mounted file does.

• creating a Secret and reading the stored value straight back out again
• consuming one two ways inside a single Pod - as environment variables and as files
• seeing how much further an environment variable spreads than a mounted file
• creating the typed Secrets, such as docker-registry, that are not Opaque

Before you start

• A cluster and kubectl.
• The session creates namespace ckad-sec, an Opaque Secret and a kubernetes.io/dockerconfigjson Secret, and two Pods consuming them.

1. 1

   Create one, and read it straight back

2. 2

   Two ways into a container

3. 3

   The env var spreads further than you think

4. 4

   The typed Secrets

Official sources

• Secrets
• Managing Secrets using kubectl
• Pull an Image from a Private Registry