Home / Knowledge hub / Kubernetes secrets
Knowledge hub
Kubernetes secrets
Kubernetes objects for passwords and keys, stored encoded but not encrypted by default.
What it means
A Kubernetes Secret is an object that holds small pieces of sensitive data, such as a database password, an API token or a TLS key. Pods can read it as environment variables or as files, so the value need not be written into the image.
The values are base64 encoded, which is a way of writing bytes as text, not a way of hiding them. Anyone who can read the Secret can decode it in one step.
Why it matters
By default Secrets sit unencrypted in the cluster's data store, etcd. So access to etcd, to a backup, or to a role that may read Secrets, is access to every password in the cluster. They are also a favourite item to look for after a foothold.
People assume the word secret means protected. Committing the manifest to a repository with the encoded value in it is the same as publishing the password, which is a classic hardcoded secret.
How it shows up
Check who can read Secrets through RBAC, including wildcard rules and the permission to list them. Turn on encryption at rest for the data store, or use an external secrets manager. Keep manifests containing values out of source control.
Prefer mounting Secrets as files over passing them as environment variables, since variables are easier to leak through logs, crash dumps and child processes. Rotate values after any suspected exposure, and give each workload only the Secrets it needs.
Questions people ask
Kubernetes secrets, answered
Are Kubernetes secrets encrypted?
Not by default. They are base64 encoded in the data store. You can enable encryption at rest for them, and managed services often offer it as an option.
Is base64 encryption?
No. It is a reversible encoding that needs no key. It exists so that arbitrary bytes can be stored as text.
Should we use an external secrets manager?
Often yes. It gives central control, rotation and audit logs. You then sync or fetch values into the cluster only when pods need them.
Who can read a Secret?
Anyone whose role allows get or list on Secrets in that namespace, plus anyone who can run a pod that mounts it. Review both.
Can we put Secrets in git?
Not as plain manifests. Use a tool that encrypts them before commit, or keep the values outside the repository.
Sources
Where this comes from
Related
Terms that sit next to this one
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
Hardcoded secret
A password, API key or token written straight into source code.
etcd exposure
An open Kubernetes data store, which holds the cluster's secrets and state.
Kubernetes RBAC
Rules for which accounts and services may do what inside a Kubernetes cluster.
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
Who can read your secrets?
We look for leaked keys and passwords in what your running app and its code expose, and show the request that proved it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.