Base64 encoding represents binary or textual data as printable characters. It is an encoding format, not encryption: anyone who can read a Base64 value can decode the original data. Kubernetes uses it where YAML and JSON cannot directly represent binary values. section 8.3.1 section 8.3.4
In a Kubernetes Secret, values in data must be Base64-encoded. The encoding applies to the manifest representation only. When Kubernetes injects the Secret into a container as an environment variable or file, it decodes the value so the application receives its original form. section 8.3.1
Base64 appears in several closely related Kubernetes fields:
- Secret data stores key–value pairs as Base64-encoded strings. section 8.3.1
- Secret stringData accepts plain text when manually encoding would be inconvenient; retrieving the object exposes the value through data as Base64. section 8.3.1
- ConfigMap binaryData stores binary content as Base64 because YAML and JSON do not inherently support binary data. section 8.3.1 section 8.2.2
A generated ConfigMap manifest
Running kubectl create configmap with a text file and a binary file places the text in data and the binary content in binaryData. The generated binaryData value appears as a Base64 string, while the text remains readable. section 8.2.2
Table 8.3 Differences in the structure of Secrets and ConfigMaps
|
Secret
|
ConfigMap
|
Description
|
|---|---|---|
data
|
binaryData
|
A map of key–value pairs. The values are Base64-encoded strings.
|
stringData
|
data
|
A map of key–value pairs. The values are plain text strings. The
stringData field in Secrets is write-only.
|
immutable
|
immutable
|
A Boolean value indicating whether the data stored in the object can be updated.
|
type
|
N/A
|
A string indicating the type of Secret. It can be any string value, but several built-in types have special requirements.
|
Compare Secret data and stringData with ConfigMap binaryData and data to see where Base64 is required and where plain text is accepted. section 8.3.1
Base64 does not make sensitive data confidential. Secret access still depends on permissions, storage protection, and handling after injection; exposed encoded values remain easy to read. section 8.3.4
