Kubernetes Secrets and their limits

Kubernetes Secrets are only base64, not encryption; protect them with RBAC, encryption at rest and file mounts, and sync them from an external secret manager with External Secrets or Sealed Secrets.

What a Secret is in Kubernetes

A Secret is an object holding small sensitive data (passwords, tokens, certs) for Pods to use without putting it into an image or a Deployment manifest.

kubectl create secret generic db-cred --from-literal=password=changeme-example
kubectl create secret tls web-tls --cert=tls.crt --key=tls.key
kubectl get secret db-cred -o jsonpath='{.data.password}' | base64 -d

Pods use Secrets in two ways:

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef: { name: db-cred, key: password }
volumes:
  - name: cred
    secret: { secretName: db-cred }   # mounted as the file /etc/cred/password

Mounting as files is usually safer than environment variables: env values leak easily into crash logs, ps or debug output, while files update when the Secret changes.

base64 is not encryption

The data field is only base64; anyone who can get the Secret can read its value. By default etcd stores Secrets almost in the clear. Therefore:

RBAC: only the right service accounts and people get get/list on Secrets; list returns values too.
Encryption at rest: enable an EncryptionConfiguration (or a KMS provider); EKS, AKS and GKE offer KMS encryption options.
Anyone who can create Pods in a namespace can mount every Secret in it, so separate namespaces per team.
Never commit real Secret manifests to Git.

Bringing secrets in from outside

flowchart LR
  SM["Vault / AWS SM / Key Vault"] --> ESO["External Secrets Operator"]
  ESO -- "create / update" --> S["Kubernetes Secret"]
  S --> P["Pod"]
  G["Git: SealedSecret (encrypted)"] --> SC["Sealed Secrets controller"] --> S

Approach	Idea
External Secrets Operator	Declare an `ExternalSecret`; the controller reads the secret manager and creates a Secret
Secrets Store CSI Driver	Mount secrets from a provider directly as files in the Pod
Sealed Secrets	Encrypt with the cluster's public key so it can be committed to Git for GitOps
SOPS	Encrypt values in YAML files with KMS or age

With GitOps (Argo CD, Flux), Sealed Secrets or External Secrets let Git stay the source of truth without holding raw secrets.

Command	Meaning
`kubectl get secrets -n app`	List Secrets
`kubectl describe secret db-cred`	Show keys without values
`kubectl auth can-i get secrets --as=system:serviceaccount:app:web`	Check permissions