Kubernetes secrets

Sometimes, services that we want to run in the Kubernetes cluster have to use confidential data such as passwords, secret API keys, or certificates, to name just a few. We want to make sure that this sensitive information can only ever be seen by the authorized or dedicated service. All other services running in the cluster should not have any access to this data.

For this reason, Kubernetes secrets were introduced. A secret is a key-value pair where the key is the unique name of the secret, and the value is the actual sensitive data. Secrets are stored in etcd. Kubernetes can be configured so that secrets are encrypted at rest – that is, in etcd – and in transit – that is, when the secrets are going over the wire from a master node to the worker nodes that the pods of the service using this secret are running on.

Manually defining secrets

We can create a secret declaratively in the same way as we can create any other object in Kubernetes...