Kubernetes Secrets

Overview

Kubernetes Secrets store sensitive data consumed by pods, such as credentials and TLS material.

Usage Patterns

• Environment variable injection
• Mounted secret volumes
• Image pull credentials

flowchart LR
    A[Kubernetes Secret] --> B[Pod]
    B --> C[Container Env Vars]
    B --> D[Mounted Volume Files]

Practical Example

apiVersion: v1
kind: Secret
metadata:
  name: api-credentials
type: Opaque
data:
  token: dG9rZW4xMjM=

Production Example

Security-focused clusters commonly encrypt Secrets at rest with KMS providers and restrict access through namespace-scoped RBAC rules.

Common Pitfalls

• Treating base64 encoding as encryption
• Broad access to secret namespaces
• No rotation process for mounted secrets

Key Takeaways

• Kubernetes Secrets require encryption and access controls.
• Namespace and RBAC boundaries reduce blast radius.
• Rotation workflows should be automated where possible.