advanced

Secret

Provide sensitive configuration to workloads while understanding encoding, encryption-at-rest, RBAC, and rotation limits.

A Kubernetes Secret stores sensitive values for workloads, but the default object is access-controlled and base64-encoded — not encrypted by itself. Real security needs RBAC, encryption at rest, external secret stores, and rotation.

					kubectl create secret generic db-url \
  --from-literal=DATABASE_URL='postgres://…'

Prefer External Secrets Operator, cloud secret managers, or sealed secrets over committing raw manifests to Git.

On interviews: secrets in images/logs/Git, service account permissions, encryption at rest, Vault integration, and rotation limits.

Common pitfalls: treating base64 as encryption; broad RBAC; logging mounted secret values.

The trade-off is Kubernetes-native convenience versus centralized secret governance.

Checklist:

Enable encryption at rest.
Limit secret RBAC narrowly.
Rotate and externalize when risk grows.
Never commit plaintext secrets to Git.