{"id":11887,"date":"2025-10-19T13:55:10","date_gmt":"2025-10-19T13:55:10","guid":{"rendered":"https:\/\/putridparrot.com\/blog\/?p=11887"},"modified":"2025-10-19T13:55:10","modified_gmt":"2025-10-19T13:55:10","slug":"kubernetes-secret-resource","status":"publish","type":"post","link":"https:\/\/putridparrot.com\/blog\/kubernetes-secret-resource\/","title":{"rendered":"Kubernetes secret resource"},"content":{"rendered":"<p>Kubernetes includes a secret resource store. <\/p>\n<p>We can get a list of secrets via the namespace<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nkubectl get secrets -n dev\r\n<\/pre>\n<p>and for all namespaces using<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nkubectl get secrets --all-namespaces\r\n<\/pre>\n<p>We can create a secret of the specified type<\/p>\n<ul>\n<li><strong>docker-registry<\/strong> Create a secret for use with a container registry<\/li>\n<li><strong>generic<\/strong> Create a secret from a local file, directory, or literal value, known as an Opaque secret type<\/li>\n<li><strong>tls<\/strong> Create a TLS secret, such as a TLS certificate and its associated key<\/li>\n<\/ul>\n<p>Hence we use the &#8220;specified type&#8221; as below (which uses a generic type)<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nkubectl create secret generic my-secret \\\r\n  --from-literal=username=admin \\\r\n  --from-literal=password=secret123 \\\r\n  -n dev\r\n<\/pre>\n<p>With the above command, we created a secret with the name <em>my-secret<\/em> and the key <em>username<\/em> with value <em>admin<\/em> followed by another key\/value.<\/p>\n<p>A secret can be created using Kubernetes YAML file with kind &#8220;Secret&#8221;<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\napiVersion: v1\r\nkind: Secret\r\nmetadata:\r\n  name: my-secret\r\ntype: Opaque\r\ndata:\r\n  username: YWRtaW4=       # base64 encoded &#039;admin&#039;\r\n  password: c2VjcmV0MTIz   # base64 encoded &#039;secret123&#039;\r\n<\/pre>\n<p>Accessing secrets, we can use the following<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nkubectl get secret my-secret -o jsonpath=&quot;{.data.username}&quot; -n dev | base64 --decode\r\nkubectl get secret my-secret -o jsonpath=&quot;{.data.username}&quot; -n dev\r\n&#x5B;System.Text.Encoding]::UTF8.GetString(&#x5B;System.Convert]::FromBase64String(&quot;YWRtaW4=&quot;)) \/\/ insert string from the above\r\n<\/pre>\n<p>Or using Powershell<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n$encoded = kubectl get secret my-secret -o jsonpath=&quot;{.data.username}&quot; -n dev\r\n&#x5B;System.Text.Encoding]::UTF8.GetString(&#x5B;System.Convert]::FromBase64String($encoded))\r\n<\/pre>\n<p>Here&#8217;s an example using a secret by including them in environment varianles<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nenv:\r\n  - name: DB_USER\r\n    valueFrom:\r\n      secretKeyRef:\r\n        name: my-secret\r\n        key: username\r\n<\/pre>\n<p>this gives us <em>process.env.DB_USER<\/em>.<\/p>\n<p>Another use is mounting via the pods volume, hence it&#8217;s file system<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nvolumes:\r\n  - name: secret-volume\r\n    secret:\r\n      secretName: my-secret\r\n\r\nvolumeMounts:\r\n  - name: secret-volume\r\n    mountPath: &quot;\/etc\/secret&quot;\r\n    readOnly: true\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Kubernetes includes a secret resource store. We can get a list of secrets via the namespace kubectl get secrets -n dev and for all namespaces using kubectl get secrets &#8211;all-namespaces We can create a secret of the specified type docker-registry Create a secret for use with a container registry generic Create a secret from a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[314],"tags":[],"class_list":["post-11887","post","type-post","status-publish","format-standard","hentry","category-kubernetes"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/11887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/comments?post=11887"}],"version-history":[{"count":5,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/11887\/revisions"}],"predecessor-version":[{"id":11952,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/11887\/revisions\/11952"}],"wp:attachment":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/media?parent=11887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/categories?post=11887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/tags?post=11887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}