Secrets & Sensitive Data
A Secret is a Kubernetes object specifically designed to hold confidential information such as passwords, OAuth tokens, SSH keys, and database credentials.
Important Security Note: By default, Kubernetes Secrets are stored as Base64 encoded plain text in `etcd`. In production, enable encryption at rest in `etcd` or integrate HashiCorp Vault.
1. Secret Types Reference
| Secret Type | Use Case |
|---|---|
Opaque (Default) | Arbitrary user-defined key-value secrets (Passwords, API Keys, DB Credentials) |
kubernetes.io/tls | Stores TLS/SSL public certificate (`tls.crt`) and private key (`tls.key`) |
kubernetes.io/dockerconfigjson | Credentials for pulling images from private container registries |
2. Production Opaque Secret Manifest
apiVersion: v1 kind: Secret metadata: name: db-credentials type: Opaque data: # Base64 encoded values (echo -n 'secretpass' | base64) DB_PASSWORD: c2VjcmV0cGFzcw== DB_USER: cm9vdA==
Next Up
Learn Storage: PersistentVolumes (PV), PersistentVolumeClaims (PVC), and StorageClasses.
Next Lesson: Storage: PV & PVC →
