A Kubernetes Secret is an API object for storing sensitive data—such as database passwords, API keys, private keys, certificates, and other credentials—separately from workload configuration. Pods can receive that data without embedding it directly in application code or ordinary configuration. section 11.4 section 11.5
Choose how a workload consumes the Secret based on the shape of the data:
- Expose a simple value such as a database password through an environment variable using valueFrom.secretKeyRef. section 11.4.1
- Mount file-oriented data such as a private SSL key as a read-only directory; each Secret key becomes a file. section 11.4.3
- Reference certificate and private-key data from an Ingress to terminate TLS connections. section 7.2.1
Define an opaque Secret with stringData for readable values, or use data with Base64-encoded content. kubectl can create Secrets imperatively, or generate YAML with --dry-run=client -o yaml for later application through configuration as code. section 11.4.3
TLS certificate for an Ingress
Create a TLS Secret from certificate files with kubectl create secret tls my-tls-cert --cert example.crt --key example.key, then set the Ingress tls.secretName to my-tls-cert. The Ingress can terminate HTTPS and forward requests to a backend over HTTP or HTTPS.
Listing 11.5 Chapter11/11.4.1_StringSecrets/deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: timeserver
spec:
replicas: 1
selector:
matchLabels:
pod: timeserver-pod
template:
metadata:
labels:
pod: timeserver-pod
spec:
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:5
env:
- name: AVATAR_ENDPOINT #1
value: http://robohash-internal #1
- name: SECRET_KEY #2
valueFrom: #2
secretKeyRef: #2
name: secrets-production #2
key: SECRET_KEY #2
#1 A regular plain-text environment variable
#2 An environment variable populated from a Secret
Inspect the Deployment pattern that injects a Secret value into the SECRET_KEY environment variable. section 11.4.1
