What is Secret?
Also known as: Kubernetes Secret
A Kubernetes Secret is an object that stores sensitive data like passwords, tokens, or keys, decoupled from pod definitions and subject to access controls.
A Kubernetes Secret is an API object designed to hold small amounts of sensitive information such as passwords, OAuth tokens, SSH keys, or TLS certificates. It separates confidential data from pod specifications and container images, reducing the risk of accidental exposure. Secrets are stored in etcd, the cluster's key-value store, and can be mounted as files or exposed as environment variables in pods.
Secrets are created using kubectl, a YAML manifest, or a generator like kustomize. The data within a Secret is base64-encoded, not encrypted by default. For production environments, Kubernetes supports encryption at rest for Secrets in etcd, and integration with external key management systems (KMS) such as AWS KMS or HashiCorp Vault can provide additional protection. Access to Secrets is governed by Role-Based Access Control (RBAC), with policies that restrict which users or service accounts can read or modify them.
Kubernetes Secrets are a core primitive for managing credentials in containerized applications. They work alongside ConfigMaps (which store non-sensitive configuration) and are often referenced by Deployments or StatefulSets. Best practices include avoiding Secrets in version control, enabling encryption at rest, and using dedicated tools like Sealed Secrets or External Secrets Operator for GitOps workflows.
Key facts
- Secrets store sensitive data as base64-encoded key-value pairs.
- They can be mounted as volumes or injected as environment variables.
- Encryption at rest for Secrets is optional and must be configured.
- RBAC policies control which principals can access or modify Secrets.
- Secrets are limited to 1 MB in size per object.
How it works in practice
Related terms
References
More in Containers & Orchestration
ConfigMap
A ConfigMap is a Kubernetes API object used to store non-confidential configuration data in key-value pairs, which pods can consume as environment variables, command-line arguments, or configuration files.
Container
A container is a lightweight, isolated runtime that packages an application with its dependencies using OS-level virtualization, enabling consistent execution across environments.
Container Image
A container image is a lightweight, standalone, executable package that includes everything needed to run a piece of software: code, runtime, system tools, libraries, and settings. It is the unit of distribution in container ecosystems like Docker and Kubernetes.
Container Registry
A container registry is a service that stores and distributes container images, enabling developers to push, pull, and version images across environments.
Container Runtime
A container runtime is the low-level software that creates, starts, and stops containers according to the OCI runtime specification, enabling process isolation and resource management.
Docker
Docker is a platform and toolchain for packaging, distributing, and running applications inside lightweight, portable containers, popularising the technology from 2013 onward.
Helm
Helm is a package manager for Kubernetes that uses charts to define, install, and upgrade complex applications as a single, versioned unit.
Ingress Controller
An Ingress Controller is a Kubernetes component that watches Ingress resources and configures a reverse proxy to route external HTTP and HTTPS traffic to services inside the cluster.
Init Container
An init container is a specialized container in a Kubernetes pod that runs to completion before any regular containers start, performing initialization or setup tasks.
Kubernetes
Kubernetes is an open source platform for automating the deployment, scaling, and management of containerized applications across clusters of hosts.