A Kubernetes Secret stores sensitive configuration as reusable key-value data. Workloads can consume it as environment-variable values or read-only volumes, much like using a dotenv file without embedding each value directly in a Deployment. section 8.1.3 section 8.6
Use a Secret when configuration should be reusable and less publicly visible than ordinary settings:
- Store passwords, API keys, and other sensitive values instead of hard-coding them in a Pod or Deployment manifest. section 8.3.5
- Attach selected key-value pairs or the complete Secret to a workload through environment-variable references. section 8.3.5
- Reuse one configuration resource across multiple Pods, Deployments, or StatefulSets rather than editing each resource separately. section 8.3.5 section 8.6
A Secret manifest
apiVersion: v1 kind: Secret metadata: name: somewhat-secret type: Opaque stringData: SECRET_YT_VIDEO: "dQw4w9WgXcQ" This declares an Opaque Secret named somewhat-secret and places one sensitive value under SECRET_YT_VIDEO. A Deployment can then reference that Secret instead of storing the value inline. section 8.3.5
Despite its name, a Kubernetes Secret is not strongly protected by default: its values are Base64-encoded rather than encrypted. External services such as HashiCorp Vault, AWS Secrets Manager, or Google Secrets Manager provide alternatives when stronger obstruction is needed. section 8.3.5 section 8.6
