Secrets are Kubernetes' mechanism for handling sensitive data — passwords, tokens, TLS certificates, SSH keys. They look similar to ConfigMaps but have important security considerations that you must understand for both production and the CKS exam.

1. Secret Types

Creating Secrets

# Opaque (generic):
kubectl create secret generic db-creds \
  --from-literal=username=admin \
  --from-literal=password='S3cr3t!Pass'

# TLS:
kubectl create secret tls web-tls \
  --cert=./tls.crt \
  --key=./tls.key

# Docker registry:
kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass \
  --docker-email=user@example.com

Declarative YAML

apiVersion: v1
kind: Secret
metadata:
  name: db-creds
type: Opaque
data:                              # ← base64 ENCODED (not encrypted!)
  username: YWRtaW4=               # echo -n "admin" | base64
  password: UzNjcjN0IVBhc3M=      # echo -n "S3cr3t!Pass" | base64

# Alternative: use stringData (plain text, converted to base64 on create):
stringData:                        # ← plain text (convenience)
  username: admin
  password: S3cr3t!Pass

2. Consuming Secrets in Pods

Same methods as ConfigMaps — env vars or volume mounts — with one key difference in how volumes work.

As Environment Variables

spec:
  containers:
    - name: app
      image: myapp:latest
      env:
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: db-creds
              key: username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-creds
              key: password
              optional: false      # Pod fails to start if Secret missing

As a Volume Mount

spec:
  containers:
    - name: app
      image: myapp:latest
      volumeMounts:
        - name: tls-certs
          mountPath: /etc/tls
          readOnly: true           # ← always set for secrets
  volumes:
    - name: tls-certs
      secret:
        secretName: web-tls
        defaultMode: 0400          # ← restrictive file permissions
# Result:
# /etc/tls/tls.crt  (0400, readable only by container user)
# /etc/tls/tls.key  (0400)

Key Differences from ConfigMap Volumes

Image Pull Secrets

# Reference a docker-registry secret for pulling private images:
spec:
  imagePullSecrets:
    - name: regcred
  containers:
    - name: app
      image: registry.example.com/myapp:latest

# Can also be attached to a ServiceAccount (applies to all Pods using it):
kubectl patch serviceaccount default -p \
  '{"imagePullSecrets": [{"name": "regcred"}]}'

3. Security Considerations

Where Secrets Are Exposed

Env Vars vs Volume Mounts for Secrets

# Env vars are visible via:
kubectl exec pod -- env | grep PASSWORD
# and in /proc/1/environ on the node (if compromised)
# and in crash dumps, logging libraries that dump env

# Volume mounts:
# - Stored in tmpfs (RAM only)
# - Can set restrictive file permissions (0400)
# - Not visible in process environment
# - Not accidentally logged

RBAC for Secrets

# Principle of least privilege:
# Most users should NOT have "get" access to Secrets
# Use separate Role for teams that need Secret access:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-reader
  namespace: app-team
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]              # Only get, not list (list exposes all!)
    resourceNames: ["db-creds"] # Only specific secrets

4. Encryption at Rest

By default, Secrets are stored unencrypted in etcd (just base64). To encrypt them at rest, configure the API server with an EncryptionConfiguration:

# /etc/kubernetes/enc/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:                    # ← encryption provider
          keys:
            - name: key1
              secret: c2VjcmV0LWtleS0xMjM0NTY3ODkwMTIzNA==  # 32-byte base64
      - identity: {}               # ← fallback: read unencrypted (for migration)

# Enable on API server (static pod manifest):
# /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
  containers:
    - command:
        - kube-apiserver
        - --encryption-provider-config=/etc/kubernetes/enc/encryption-config.yaml
      volumeMounts:
        - name: enc-config
          mountPath: /etc/kubernetes/enc
          readOnly: true
  volumes:
    - name: enc-config
      hostPath:
        path: /etc/kubernetes/enc

Encryption Providers

After Enabling Encryption

# Existing Secrets are still unencrypted! Re-write them:
kubectl get secrets --all-namespaces -o json | \
  kubectl replace -f -
# This reads and re-writes every Secret, encrypting it with the new provider

# Verify encryption:
etcdctl get /registry/secrets/default/db-creds | hexdump -C
# Should show encrypted bytes (k8s:enc:aescbc:...) not plain text

Summary