A Secret has the same shape as a ConfigMap. The difference is intent and encoding: values are stored base64-encoded, RBAC usually restricts who can read them, and they belong in a vault or a sealed form, never in git.
Create and read
sh
kubectl create secret generic db-creds --from-literal=MONSTER_DB_URL=postgres://market:s3cret@market-db:5432/market
kubectl get secret db-creds -o yaml
kubectl get secret db-creds -o jsonpath='{.data.MONSTER_DB_URL}' | base64 -dtext
plain postgres://market:s3cret@market-db:5432/market
│ base64 encode
data cG9zdGdyZXM6Ly9tYXJrZXQ6czNjcmV0QG1hcmtldC1kYjo1NDMyL21hcmtldA==
│ base64 -d
plain postgres://market:s3cret@market-db:5432/marketEncoding is reversible. It is not encryption.
Types
| Type | Use |
|---|---|
generic (Opaque) | Arbitrary key/value pairs |
docker-registry | Image pull credentials |
tls | A certificate and its key |
Use it in a Pod
yaml
env:
- name: MONSTER_DB_URL
valueFrom:
secretKeyRef:
name: db-creds
key: MONSTER_DB_URLOr mount it, one file per key:
yaml
volumes:
- name: creds
secret:
secretName: db-credsRotation
Replacing the Secret does not touch running containers. Their environment was fixed when they started.
sh
kubectl delete secret db-creds
kubectl create secret generic db-creds --from-literal=MONSTER_DB_URL=<new>
kubectl rollout restart deploy/market-apiThe Secret is replaced, then the Pods are recreated; the new ones read the new value.