Introduction

In Kubernetes, secrets are used to manage sensitive information such as passwords, OAuth tokens, and SSH keys. They help to keep your application secure by avoiding the exposure of sensitive data in configuration files or code. In this article, we'll delve into how to set secrets in Kubernetes using YAML.

Understanding Kubernetes Secrets

Kubernetes secrets are objects designed to hold sensitive data, such as a token, password, or key. The platform provides this mechanism to ensure that such sensitive information does not appear in your application's pod specs in plain text.

Why Use Kubernetes Secrets?

1. Security: Secrets are stored in a more secure manner as compared to ConfigMaps. The data in secrets can be encrypted at rest.
2. Separation of Concerns: Secrets allow you to separate sensitive data from application code.
3. Flexibility: Kubernetes secrets can dynamically inject data into containers, allowing for greater flexibility.
4. Access Control: Access to secrets can be fine-tuned using RBAC (Role-Based Access Control).

Secrets in YAML

Kubernetes secrets can be created in two ways:

1. Imperatively using kubectl commands.
2. Declaratively using YAML manifest files.

In this guide, we focus on the latter approach.

Basic YAML Structure of a Secret

Here's a basic template for defining a secret in YAML:

1apiVersion: v1
2kind: Secret
3metadata:
4  name: my-secret
5type: Opaque
6data:
7  <key>: <base64-encoded-value>

Example: Creating a Secret YAML File

Suppose you want to store a database username and password as secrets. First, you must encode these values in Base64 format. Kubernetes secrets expect Base64-encoded data.

Encode Data in Base64

If your username is admin and password is P@ssw0rd, you can encode them using Base64 encoding:

1echo -n 'admin' | base64
2# Output: YWRtaW4=
3
4echo -n 'P@ssw0rd' | base64
5# Output: UEBzc3cwcmQ=

Create the Secret YAML File

Using the Base64 encoded values, you can create the YAML manifest:

1apiVersion: v1
2kind: Secret
3metadata:
4  name: db-secret
5type: Opaque
6data:
7  username: YWRtaW4=
8  password: UEBzc3cwcmQ=

Applying the Secret to the Cluster

To create a secret in your Kubernetes cluster from your YAML file, use the kubectl command:

kubectl apply -f secret.yaml

Using Secrets in Pods

Once the secret is created, you can use it in your pods. Mounting secrets as environment variables is a common practice.

Example Pod Spec

Here’s an example of how to mount a secret as an environment variable inside a pod:

1apiVersion: v1
2kind: Pod
3metadata:
4  name: db-client
5spec:
6  containers:
7    - name: my-container
8      image: my-image
9      env:
10        - name: DB_USERNAME
11          valueFrom:
12            secretKeyRef:
13              name: db-secret
14              key: username
15        - name: DB_PASSWORD
16          valueFrom:
17            secretKeyRef:
18              name: db-secret
19              key: password

In this scenario, the DB_USERNAME and DB_PASSWORD environment variables are automatically populated with the data from the db-secret secret.

Additional Considerations

Secret Management Strategy

• Version Control: Avoid including secrets in your source code repository. Use a dedicated secret management solution, or access control mechanisms.
• Encryption at Rest: Ensure that secrets stored in etcd are encrypted to provide an additional layer of security.
• RBAC and Access Control: Implement fine-grained access controls to ensure that only authorized entities can access secret data.

Limitations and Tips

• Size Limit: Each secret can have a maximum size limit of 1MB.
• Base64 Encoding: Always remember to encode your secret data using Base64 before inserting it into your YAML definitions. Failing to do so could result in errors.

Conclusion

Kubernetes secrets provide a secure, flexible, and organized method for storing and managing sensitive data. With proper management practices such as encryption, RBAC, and not storing sensitive information in version control, Kubernetes secrets can significantly enhance the security posture of your containerized applications.

Summary Table