Secrets Intro

What a Secret is

A Secret holds small sensitive pieces of data. Kubernetes base64-encodes values in etcd by default—that is encoding, not encryption at rest unless the cluster is configured for it.

Create a generic Secret

Learning-only example:

kubectl create secret generic app-secret \
  --from-literal=API_TOKEN=learning-only
kubectl get secret app-secret

Consume like ConfigMaps

Mount as files or inject as environment variables from a pod spec. Prefer files when tooling supports it.

Safety habits

• Never commit real Secret YAML with live credentials
• Use unique practice values in local clusters
• Limit who can read Secrets in shared environments
• Graduate to a cloud secret manager for production