Kubernetes: how do I manage secrets safely?
asked 3 months ago70 viewsen
Kubernetes Secrets are just base64-encoded. I don't want DB passwords sitting in plain YAML in our git repo. What's the recommended approach?
AI diagnosis
AI-generated. Not an answer — the community below confirms or corrects it. Always verify before relying on it.
1 Answer
Correct, base64 is encoding, not encryption. Layered approach:
1. Never commit plain Secrets. Choose one of: - External Secrets Operator: syncs from AWS Secrets Manager, Azure Key Vault, GCP Secret Manager or Vault into K8s Secrets. Git only holds a reference. - Sealed Secrets or SOPS (with age/KMS): encrypted secrets that are *safe* to commit and decrypted in-cluster. 2. Enable encryption at rest for etcd (managed clusters usually do this; verify it). 3. RBAC: restrict get/list on Secrets. Many people with namespace access can otherwise read them all. 4. Prefer workload identity (IRSA on EKS, Workload Identity on GKE/AKS) so pods authenticate to cloud services without long-lived keys at all. 5. Mount secrets as files rather than env vars where possible, since env vars leak into crash dumps and debug output.
Sign in to tell others whether this worked.
Sign in and verify your email to post an answer.