Introduction to Kubernetes Secrets

In this blog post, we are going to discuss K8s secrets, including:

• What secrets are
• How to create a secret
• How to work with secrets

I assume you have a basic understanding of Kubernetes and concepts like pod, deployment, service, etc. To follow along, you will need to have kubectl and minikube installed.

(This article is part of our Kubernetes Guide. Use the right-hand menu to navigate.)

What is a K8s secret?

A secret as the name implies is any information that need to be kept confidential such as password, token, etc.

You can technically put the credentials directly into a pod specification in plain text but doing that is not very safe as you can imagine. To solve this, Kubernetes has the concept of secrets where you can store your sensitive info securely and also control how a pod consumes it.

How to create secrets?

In general both user and kubernetes itself can create a secret. If all you need is to access the API securely, then K8s can automatically create a secret attached to a service account which contains credentials to access the API. This is the recommended way to access the API.

In the situation where we need to create our own secret for other uses, we can do that as well. Take for example we have a pod running our application that need to access another system with the username “example-user” and password “example-password”, how do we create the secret and get our pod to recognize and use the credentials? We can create it manually or with a yaml file or “kubectl create”.

Manually create a secret

To create secret manually, we must first convert the string to base64.

$ echo -n 'example-user' | base64
4oCYZXhhbXBsZS11c2Vy4oCZ
$ echo -n 'example-password' | base64
4oCYZXhhbXBsZS1wYXNzd29yZOKAmQ==

Then we create a yaml file (example.yaml) with our secret specs.

apiVersion: v1
kind: Secret
metadata:
name: demo
type: Opaque
data:
username: 4oCYZXhhbXBsZS11c2Vy4oCZ
password: 4oCYZXhhbXBsZS1wYXNzd29yZOKAmQ==

We can check if secret was created

$ kubectl get secret
NAME                  TYPE                                  DATA      AGE
default-token-v8gqd      3         6m
demo                  Opaque                                2         11s

As you can see we have a system generated secret and the one we just created. We can also describe our secret just to make sure our secret is not in plain text.

Type:  Opaque
Data
====
username:  18 bytes
password:  22 bytes

Create secret with kubectl

We can also create secret from a file that contains the credentials. So for example we could create the same secret by saving the username in a file called username.txt and password in password.txt. We can then run “kubectl create secret generic demo-creds –from-file=./username.txt –from-file=./password.txt“.