Full lesson
Explore the full explanation, examples, and visuals at your own pace.
secret.yaml, committed to GitHub
Your Kubernetes Secret is one command away from plain text. Here's a secret.yaml a developer committed to GitHub. See the password value under data? They believed that string was encrypted. It isn't, and anyone who can read this file can recover the password.
apiVersion: v1
kind: Secret
metadata:
name: db-secret
data:
password: cGFzc3dvcmQxMjM=No key needed, one command
Base64 is an encoding, a way to write text so it's safe to store and transfer. It isn't a lock. Run base64 -d on that string, and out comes password123. No key is involved, so anyone who can read the file can read the password.
The fix
So treat every Secret value in YAML as plain text. Keep real values out of Git, and keep those files out of the repo, or encrypt them before storing. Base64 isn't a lock. It's just a different alphabet.
- Never commit real Secret values
- Keep Secret files out of the repo
- Or encrypt them before storing