Templating Kubernetes Secret Resources
Rendering Secret objects without leaking values.
Templating Kubernetes Secret Resources is a free Helm Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Charts Can Render Secrets
Sometimes your chart must produce a Kubernetes Secret object itself. Done carefully, you can template one without leaking the value.
The Secret Manifest Shape
A Kubernetes Secret is just a manifest with a data section. Each value under data must be Base64-encoded text.
apiVersion: v1
kind: Secret
metadata:
name: db-credentialsEncode data with b64enc
Under data, you encode each value. The Sprig helper b64enc converts a plaintext string into the Base64 form Kubernetes expects.
data:
password: {{ .Values.password | b64enc }}Use stringData to Skip Encoding
Prefer stringData when you want to avoid b64enc by hand. Kubernetes encodes those values for you on the server side.
stringData:
password: {{ .Values.password | quote }}Encoding Still Is Not Secret
Remember the value rendered into the manifest is only encoded. Whoever can read it back can decode it instantly.
Do Not Print It in NOTES
A common leak is echoing the value in NOTES.txt. Print how to fetch it instead, so the plaintext never lands in command output.
Reuse an Existing Secret
Better still, let users point to an existingSecret they created out of band, so your chart never receives the value at all.
{{- if not .Values.existingSecret }}
kind: Secret
{{- end }}require a Mandatory Value
When a secret really is required, the required function stops rendering with a clear message if the value is missing.
password: {{ required "password is required" .Values.password | b64enc }}Mount, Do Not Inline
Have pods read the Secret through secretKeyRef or a mounted volume, rather than baking the literal value into a container env.
valueFrom:
secretKeyRef:
name: db-credentials
key: passwordAnnotate for Rotation
To roll pods when a Secret changes, add a checksum annotation to the deployment so a new value triggers a restart.
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}Combine the Strategies
The strongest charts combine ideas: prefer existing or external secrets, encode only when needed, and never echo the value.
Quick Check
How do you let Kubernetes do the Base64 encoding for you?
Recap
You learned to template a Secret safely: encode with b64enc or stringData, prefer existing secrets, and never print the value. 🎉
Frequently asked questions
Is the “Templating Kubernetes Secret Resources” lesson free?
Yes — the full text of “Templating Kubernetes Secret Resources” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.
What will I learn in “Templating Kubernetes Secret Resources”?
Rendering Secret objects without leaking values. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Helm Academy?
No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Templating Kubernetes Secret Resources” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Helm Academy lesson?
Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Secrets Do Not Belong in values.yaml
- Encrypting Values with helm-secrets and SOPS
- Pulling from External Secrets Operators
- Templating Kubernetes Secret Resources