DevOps Bootcamp · Lesson

Secrets for Sensitive Data

Securely store and manage sensitive information like passwords and API keys using Secrets.

Secrets for Sensitive Data is a free DevOps Bootcamp lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Protecting Sensitive Info

When building applications, you often deal with sensitive information like database passwords, API keys, or private certificates.

Storing these directly in your application code or configuration files is a big security risk! It can lead to data breaches and expose your system.

Introducing Kubernetes Secrets

Kubernetes Secrets are objects designed to store sensitive data securely within your cluster.

They help you keep sensitive information separate from your Pod definitions and application code, making your deployments safer and more manageable.

Separate: Keep sensitive data out of container images and Pod YAML.
Accessible: Pods can consume them as environment variables or mounted files.

Secrets vs. ConfigMaps

You might recall ConfigMaps from a previous lesson, used for non-sensitive configuration data.

Secrets are similar but specifically for sensitive data. Both store key-value pairs, but Secrets handle the sensitive nature.

ConfigMaps: For general, non-sensitive config (e.g., log levels, API endpoints).
Secrets: For sensitive data (e.g., passwords, tokens, private keys).

Remember, Secrets are base64 encoded, not encrypted by default!

Create Secret from Literal

The simplest way to create a Secret is from a literal value using kubectl create secret generic.

This is useful for single, short pieces of sensitive data like a simple password.

kubectl create secret generic my-db-secret \
  --from-literal=username=admin \
  --from-literal=password=SuperSecretP@ssw0rd!

Create Secret from Files

For larger or multi-line sensitive data (like a private key or a full config file), it's better to create a Secret from files.

First, create the files locally, then reference them. Kubernetes will read the file content and store it.

# Create local files first
echo "my-api-key-12345" > api-key.txt
echo "my-token-abcde" > auth-token.txt

# Create the Secret
kubectl create secret generic app-credentials \
  --from-file=api-key.txt \
  --from-file=auth-token.txt

Use Secrets as Env Variables

Pods can consume Secret data by injecting it directly into their environment variables. This is common for simple key-value pairs.

You can reference individual keys from a Secret, or all of them using envFrom.

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod-env
spec:
  containers:
  - name: my-app
    image: nginx:latest
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: my-db-secret
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-db-secret
          key: password

Use Secrets as Mounted Files

For sensitive files (like certificates, private keys), or when an application expects configuration from specific file paths, you can mount Secrets as files within a Pod.

Each key in the Secret becomes a file in the mounted directory, with its value as the file's content.

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod-vol
spec:
  containers:
  - name: my-app
    image: nginx:latest
    volumeMounts:
    - name: app-secret-volume
      mountPath: "/etc/secrets"
      readOnly: true
  volumes:
  - name: app-secret-volume
    secret:
      secretName: app-credentials

Security for Your Secrets

While Secrets protect data from casual inspection, they are not a silver bullet. Remember these points:

Base64 Encoding: Secrets are base64 encoded, not encrypted. Anyone with access to the Secret can decode it.
RBAC: Use Role-Based Access Control (RBAC) to restrict who can read, create, or modify Secrets.
Encryption at Rest: For true security, enable encryption at rest for your etcd (Kubernetes' backing store) data. Cloud providers often offer this.

Updating Secrets

If your sensitive data changes, you'll need to update the Secret. Simply re-running kubectl create secret with new values will update it, or use kubectl apply -f with an updated YAML.

However, running Pods that consume the Secret will not automatically pick up the changes. To apply changes, you typically need to restart or redeploy the Pods that use the Secret.

Quick Check: Secrets

Imagine you have a private API key you need your application to access. Which method is the most secure and appropriate for storing and providing this key to a Kubernetes Pod?

Recap: Secrets for Sensitive Data

Great job! You've learned how to handle sensitive data in Kubernetes!

Secrets store sensitive info like passwords and API keys.
They are base64 encoded and can be consumed as environment variables or mounted files.
Always apply RBAC and consider encryption at rest for maximum security.
Remember, Pods need to be restarted to pick up Secret updates.

Frequently asked questions

Is the “Secrets for Sensitive Data” lesson free?

Yes — the full text of “Secrets for Sensitive Data” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Secrets for Sensitive Data”?

Securely store and manage sensitive information like passwords and API keys using Secrets. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secrets for Sensitive Data” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to DevOps Bootcamp