Kubernetes Secrets: How to Create, Use, and Manage Secrets

Introduction

Sensitive information like API keys, database credentials, or SSH keys must be handled securely to protect your systems and data. Kubernetes Secrets provide a mechanism to manage such information effectively by decoupling sensitive data from application logic.

This article covers the fundamentals of Kubernetes Secrets, how to create and use them, and best practices for secure management. By the end, you'll be able to integrate Secrets into your applications securely and efficiently.

What Are Kubernetes Secrets?

A Kubernetes Secret is an object that stores sensitive data in key-value pairs. Unlike ConfigMaps, Secrets are designed specifically for confidential data, and their content is base64-encoded.

Why Use Secrets?

• Security: Secrets are not visible in plaintext in configurations or logs.
• Decoupling: Sensitive data is kept separate from application code and images.
• Dynamic Updates: Secrets can be updated without requiring a container image rebuild.

Types of Data Managed by Secrets

Common examples of data stored in Kubernetes Secrets:

• Database Credentials: Username and password for database access.
• API Keys: Access keys for third-party services.
• SSH Keys: Secure Shell keys for remote server access.
• TLS Certificates: Certificates and private keys for HTTPS communication.
• OAuth Tokens: Authentication tokens for services like GitHub or Google.

Creating a Secret in Kubernetes

1. Using the kubectl Command

Create a secret using literal values:

kubectl create secret generic my-secret \ --from-literal=username=myuser \ --from-literal=password=mypassword 

Verify the secret:

kubectl get secret my-secret -o yaml 

2. Defining Secrets in a YAML File

Define a Secret in secret.yaml:

apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: username: bXl1c2Vy # Base64 encoded value of 'myuser' password: bXlwYXNzd29yZA== # Base64 encoded value of 'mypassword' 

Create the Secret:

kubectl apply -f secret.yaml 

3. From a File

Create a file username.txt with the content myuser:

kubectl create secret generic file-secret --from-file=username=username.txt 

Using a Secret in Pods and Deployments

1. Accessing Secrets as Environment Variables

Define a Pod using the Secret:

apiVersion: v1 kind: Pod metadata: name: secret-env-pod spec: containers: - name: app-container image: busybox command: ["sh", "-c", "echo $DB_USERNAME && echo $DB_PASSWORD && sleep 3600"] env: - name: DB_USERNAME valueFrom: secretKeyRef: name: my-secret key: username - name: DB_PASSWORD valueFrom: secretKeyRef: name: my-secret key: password restartPolicy: Never 

Apply the Pod and view the output:

kubectl apply -f pod-env.yaml kubectl logs secret-env-pod 

2. Mounting Secrets as Volumes

Define a Pod that mounts the Secret as a volume:

apiVersion: v1 kind: Pod metadata: name: secret-volume-pod spec: containers: - name: app-container image: busybox command: ["sh", "-c", "cat /etc/secret-volume/username && cat /etc/secret-volume/password && sleep 3600"] volumeMounts: - name: secret-volume mountPath: /etc/secret-volume volumes: - name: secret-volume secret: secretName: my-secret 

Apply the Pod and inspect the mounted files:

kubectl apply -f pod-volume.yaml kubectl exec -it secret-volume-pod -- ls /etc/secret-volume kubectl exec -it secret-volume-pod -- cat /etc/secret-volume/username 

Managing Existing Secrets

Updating a Secret

To update a Secret, recreate it:

kubectl delete secret my-secret kubectl create secret generic my-secret --from-literal=username=newuser --from-literal=password=newpassword 

Rolling Updates

If a Deployment uses Secrets, updating the Secret will not trigger a Pod restart. To ensure changes take effect, manually restart the Pods:

kubectl rollout restart deployment my-deployment 

Accessing Secrets in Applications

Secrets can be accessed programmatically using environment variables or mounted files. Here's an example in Python:

import os username = os.getenv("DB_USERNAME") password = os.getenv("DB_PASSWORD") print(f"Username: {username}, Password: {password}") 

Best Practices for Managing Secrets

1. Encrypt Secrets at Rest: Use encryption mechanisms like Kubernetes Encryption at Rest.
2. Use RBAC: Restrict access to Secrets using Role-Based Access Control (RBAC).
3. Avoid Hardcoding: Never hardcode sensitive data in application code.
4. Automate Secret Rotation: Use tools like HashiCorp Vault or AWS Secrets Manager for automatic rotation.
5. Audit Access: Regularly audit access logs for Secrets.
6. Namespace Isolation: Create Secrets in the same namespace as their consumers.

Hands-On Tutorial: Deploying a Sample Application

Step 1: Create a Secret

kubectl create secret generic sample-secret --from-literal=username=appuser --from-literal=password=apppassword 

Step 2: Deploy a Sample App

Create a deployment.yaml file:

apiVersion: apps/v1 kind: Deployment metadata: name: sample-app spec: replicas: 1 selector: matchLabels: app: sample-app template: metadata: labels: app: sample-app spec: containers: - name: app-container image: nginx env: - name: APP_USERNAME valueFrom: secretKeyRef: name: sample-secret key: username 

Apply the Deployment:

kubectl apply -f deployment.yaml 

Step 3: Verify the Secret

Access the Pod:

kubectl exec -it <pod-name> -- printenv | grep APP_USERNAME 

Troubleshooting Common Issues

1. Base64 Encoding Errors: Ensure all values in YAML files are base64-encoded.
2. Access Denied: Check RBAC policies to ensure the Pod has access to the Secret.
3. Missing Keys: Verify the key names in the Secret definition match those used in Pod specifications.

Conclusion

Kubernetes Secrets provide a secure and efficient way to manage sensitive information in containerized applications. By following the practices outlined in this guide, you can ensure the security and integrity of your applications while simplifying configuration management. Start incorporating Secrets into your Kubernetes projects today!

For further learning, refer to the official Kubernetes Secrets documentation.