Using Secrets for Sensitive Data
notes-web needs the database password. Put it in a ConfigMap and anyone who can read ConfigMaps can read it; put it in the image and anyone who can pull the image can. Secrets are the Kubernetes object for values that must be guarded.
The rule
A Secret is encoded, not encrypted — protect it with access, not with base64.
A Secret looks like a ConfigMap and is used the same ways — as env variables or as mounted files. The differences are in handling:
- Values under
dataare base64-encoded. That is an encoding, not encryption: anyone can decode it in one command. - Kubernetes treats Secrets more carefully: they can be encrypted at rest in etcd (when the cluster is configured for it), are kept in memory rather than on disk on nodes, and can be locked down separately with RBAC.
Writing a Secret is easiest with stringData, which takes plain text and encodes it for you:
apiVersion: v1
kind: Secret
metadata:
name: notes-db-credentials
namespace: notes
type: Opaque
stringData:
POSTGRES_USER: notes
POSTGRES_PASSWORD: change-me-pleaseUsing one key in a pod:
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: notes-db-credentials
key: POSTGRES_PASSWORDOr from the command line, which avoids writing the value to any file:
kubectl create secret generic notes-db-credentials --from-literal=POSTGRES_PASSWORD='change-me-please' -n notesOther built-in types include kubernetes.io/tls for certificates and kubernetes.io/dockerconfigjson for private registry logins.
The shortcut
For every value ask: "Would I be upset if this appeared in a screenshot?" Yes → Secret. No → ConfigMap. Then check the three guards: who can read it (RBAC), is it encrypted at rest, and is it kept out of Git?
LOG_LEVEL and DB_HOST
Harmless in a screenshot: ConfigMap.
The encoding trap: echo "pass" | base64 includes a newline, so the stored password becomes pass plus a newline. Use echo -n, or better, stringData.
Drills
Answer fast — trust the rule.
The data field of a Secret holds Y2hhbmdlLW1l. Is the password protected by this?
Which field lets you write Secret values as plain text in the manifest?
Which value belongs in a Secret rather than a ConfigMap?
Which practice actually keeps notes-db-credentials safe?
A Secret was built with echo "hunter2" | base64 and the app's login now fails. Why?
Remember
- A Secret is encoded, not encrypted — protect it with RBAC, encryption at rest, and keeping it out of Git.
- Upsetting in a screenshot → Secret; harmless → ConfigMap.
- Trap:
echowithout-nsneaks a newline into the value.