{"id":77367,"date":"2026-07-04T03:20:48","date_gmt":"2026-07-04T03:20:48","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=77367"},"modified":"2026-07-04T03:20:51","modified_gmt":"2026-07-04T03:20:51","slug":"kubernetes-configmap-vs-secret-updated-reference-for-kubernetes","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/kubernetes-configmap-vs-secret-updated-reference-for-kubernetes\/","title":{"rendered":"Kubernetes ConfigMap vs Secret \u2014 Updated Reference for Kubernetes"},"content":{"rendered":"\n

As of July 4, 2026<\/strong>, the current stable upstream Kubernetes line is Kubernetes v1.36<\/strong>, with v1.36.2 released on June 9, 2026<\/strong>. Kubernetes v1.37 is in release-cycle\/pre-release status, not the stable baseline yet. Kubernetes currently maintains the latest three minor release branches: 1.36, 1.35, and 1.34<\/strong>. (Kubernetes<\/a>)<\/p>\n\n\n\n

\n\n\n\n

1. ConfigMap vs Secret \u2014 First Compare<\/h2>\n\n\n\n
Area<\/th>ConfigMap<\/th>Secret<\/th><\/tr><\/thead>
Main purpose<\/td>Store non-sensitive configuration<\/strong><\/td>Store sensitive configuration<\/strong><\/td><\/tr>
Examples<\/td>App mode, log level, feature flags, URLs, config files<\/td>Passwords, API keys, tokens, TLS certs, registry credentials<\/td><\/tr>
Kubernetes object kind<\/td>ConfigMap<\/code><\/td>Secret<\/code><\/td><\/tr>
Namespace scoped?<\/td>Yes<\/td>Yes<\/td><\/tr>
Stored under<\/td>data<\/code> and optional binaryData<\/code><\/td>data<\/code> and optional stringData<\/code><\/td><\/tr>
Encoding behavior<\/td>data<\/code> is plain UTF-8 text; binaryData<\/code> is base64<\/td>data<\/code> must be base64-encoded; stringData<\/code> accepts plain text and Kubernetes converts it<\/td><\/tr>
Is base64 encryption?<\/td>No<\/td>No<\/td><\/tr>
Encrypted by default in upstream Kubernetes?<\/td>No, unless API data encryption is configured<\/td>No, unless API data encryption is configured<\/td><\/tr>
Best for Git?<\/td>Usually safe if no secrets<\/td>Unsafe unless encrypted with SOPS, Sealed Secrets, Vault, External Secrets, etc.<\/td><\/tr>
Access control<\/td>RBAC<\/td>RBAC, but must be stricter<\/td><\/tr>
Can be consumed as env vars?<\/td>Yes<\/td>Yes<\/td><\/tr>
Can be mounted as files?<\/td>Yes<\/td>Yes<\/td><\/tr>
Immutable support<\/td>Yes, using immutable: true<\/code><\/td>Yes, using immutable: true<\/code><\/td><\/tr>
Maximum object size<\/td>Should stay small; practical limit around Kubernetes object size<\/td>Same; Secrets are intended for small sensitive values<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A ConfigMap<\/strong> stores configuration for applications and has data<\/code> for UTF-8 strings and binaryData<\/code> for base64-encoded binary data. A Secret<\/strong> is meant for confidential data; values in the data<\/code> field must be base64-encoded, while stringData<\/code> lets you submit plain strings that the API server converts into data<\/code>. (Kubernetes<\/a>)<\/p>\n\n\n\n

The biggest trap: Kubernetes Secret base64 is not encryption<\/strong>. Anyone who can run kubectl get secret<\/code> can decode it.<\/p>\n\n\n\n

\n\n\n\n

2. Hands-on: Prove ConfigMap Is Plain and Secret Is Encoded<\/h1>\n\n\n\n

Create a test namespace:<\/p>\n\n\n

kubectl create namespace<\/span> cm<\/span>-secret<\/span>-lab<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
2.1 Create a ConfigMap<\/h2>\n\n\n
kubectl -n cm-secret-lab create configmap app-config \\\n  --from<\/span>-literal=APP_MODE=prod \\\n  --from<\/span>-literal=LOG_LEVEL=debug \\\n  --from<\/span>-literal=DB_HOST=mysql.dev.svc.cluster.local\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
View it:<\/p>\n\n\n
kubectl -n cm-secret-lab get<\/span> configmap app-config -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Expected output style:<\/p>\n\n\n
apiVersion<\/span>: v1<\/span>\nkind<\/span>: ConfigMap<\/span>\nmetadata<\/span>:\n  name<\/span>: app-config<\/span>\n  namespace<\/span>: cm-secret-lab<\/span>\ndata<\/span>:\n  APP_MODE<\/span>: prod<\/span>\n  DB_HOST<\/span>: mysql<\/span>.dev<\/span>.svc<\/span>.cluster<\/span>.local<\/span>\n  LOG_LEVEL<\/span>: debug<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Notice: values are plain text<\/strong>.<\/p>\n\n\n\n
You can also print one value:<\/p>\n\n\n
kubectl -n cm-secret-lab get configmap app-config \\\n  -o jsonpath='{.data.DB_HOST}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
mysql<\/span>.dev<\/span>.svc<\/span>.cluster<\/span>.local<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
2.2 Create a Secret<\/h2>\n\n\n
kubectl -n cm-secret-lab create secret generic app-secret \\\n  --from<\/span>-literal=DB_PASSWORD='P@ssw0rd!'<\/span> \\\n  --from<\/span>-literal=API_KEY='abc123'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
View it:<\/p>\n\n\n
kubectl -n cm-secret-lab get<\/span> secret app-secret -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Expected output style:<\/p>\n\n\n
apiVersion: v1\nkind: Secret\nmetadata:\n  name: app-secret\n  namespace<\/span>: cm<\/span>-secret<\/span>-lab<\/span>\ntype<\/span>: Opaque<\/span>\ndata<\/span>:\n  API_KEY<\/span>: YWJjMTIz<\/span>\n  DB_PASSWORD<\/span>: UEBzc3cwcmQh<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Here:<\/p>\n\n\n
abc123<\/span>     -<\/span>> YWJjMTIz<\/span>\nP<\/span>@ssw0rd<\/span>! -> UEBzc3cwcmQh\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
That is base64 encoding<\/strong>, not encryption.<\/p>\n\n\n\n
\n\n\n\n
2.3 Compare Side by Side<\/h2>\n\n\n
echo<\/span> \"===== ConfigMap =====\"<\/span>\nkubectl -n cm-secret-lab get configmap app-config -o yaml\n\necho<\/span> \"===== Secret =====\"<\/span>\nkubectl -n cm-secret-lab get secret app-secret -o yaml\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
You will see:<\/p>\n\n\n
# ConfigMap<\/span>\ndata:\n  APP_MODE: prod\n  LOG_LEVEL: debug\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
But Secret shows:<\/p>\n\n\n
# Secret<\/span>\ndata:\n  API_KEY: YWJjMTIz\n  DB_PASSWORD: UEBzc3cwcmQh\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
3. Secret Encoding Mechanism<\/h1>\n\n\n\n
Kubernetes Secrets have two common input styles.<\/p>\n\n\n\n
3.1 data<\/code>: You provide base64 yourself<\/h2>\n\n\n
apiVersion: v1\nkind: Secret\nmetadata:\n  name: manual-secret\ntype: Opaque\ndata:\n  username: YWRtaW4=\n  password: UEBzc3cwcmQh\n<\/code><\/span><\/pre>\n\n\n
Decode mentally:<\/p>\n\n\n
YWRtaW4=       -> admin\nUEBzc3cwcmQh   -> P@ssw0rd!\n<\/code><\/span><\/pre>\n\n\n
Apply:<\/p>\n\n\n
kubectl<\/span> apply<\/span> -f<\/span> manual-secret<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
3.2 stringData<\/code>: You provide plain text, Kubernetes converts it<\/h2>\n\n\n
apiVersion<\/span>: v1<\/span>\nkind<\/span>: Secret<\/span>\nmetadata<\/span>:\n  name<\/span>: stringdata-secret<\/span>\ntype<\/span>: Opaque<\/span>\nstringData<\/span>:\n  username<\/span>: admin<\/span>\n  password<\/span>: P<\/span>@ssw0rd<\/span>!\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Apply it:<\/p>\n\n\n
kubectl<\/span> -n<\/span> cm-secret-lab<\/span> apply<\/span> -f<\/span> stringdata-secret<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Now view it:<\/p>\n\n\n
kubectl -n cm-secret-lab get<\/span> secret stringdata-secret -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
You will see data<\/code>, not stringData<\/code>:<\/p>\n\n\n
data:\n  password: UEBzc3cwcmQh\n  username: YWRtaW4=\n<\/code><\/span><\/pre>\n\n\n
stringData<\/code> is only a convenience input field. The Kubernetes API stores the result in data<\/code>, and data<\/code> values are base64-encoded strings. (Kubernetes<\/a>)<\/p>\n\n\n\n
\n\n\n\n
4. How to Decode Kubernetes Secrets<\/h1>\n\n\n\n
4.1 Decode one key<\/h2>\n\n\n
kubectl -n cm-secret-lab get secret app-secret \\\n  -o jsonpath='{.data.DB_PASSWORD}'<\/span> | base64 --decode\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
P<\/span>@ssw0rd<\/span>!\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
On some systems, use:<\/p>\n\n\n
kubectl -n cm-secret-lab get secret app-secret \\\n  -o jsonpath='{.data.DB_PASSWORD}'<\/span> | base64 -d\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4.2 Decode API key<\/h2>\n\n\n
kubectl -n cm-secret-lab get secret app-secret \\\n  -o jsonpath='{.data.API_KEY}'<\/span> | base64 --decode\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
abc123\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
4.3 Decode all keys using jq<\/code><\/h2>\n\n\n
kubectl -n cm-secret-lab get<\/span> secret app-secret -o json \\\n  | jq -r '.data | map_values(@base64d)'\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
{\n  \"API_KEY\"<\/span>: \"abc123\"<\/span>,\n  \"DB_PASSWORD\"<\/span>: \"P@ssw0rd!\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4.4 Decode all secrets in a namespace \u2014 audit style<\/h2>\n\n\n\n
Careful: this prints sensitive values.<\/p>\n\n\n
kubectl -n cm-secret-lab get secrets -o json \\\n  | jq -r '.items[] | \n    \"SECRET: \\(.metadata.name)\\n\" +\n    (.data \/\/ {} | to_entries[]? | \"\\(.key)=\\(.value | @base64d)\") +\n    \"\\n\"'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4.5 Decode manually<\/h2>\n\n\n
echo<\/span> 'UEBzc3cwcmQh'<\/span> | base64 --decode\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
P<\/span>@ssw0rd<\/span>!\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4.6 Decode in PowerShell<\/h2>\n\n\n
[System.Text.Encoding]<\/span>::UTF8.GetString(<\/span>\n  [System.Convert]<\/span>::FromBase64String(\"UEBzc3cwcmQh\")<\/span>\n)\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
P<\/span>@ssw0rd<\/span>!\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
5. Consuming ConfigMap and Secret in a Pod<\/h1>\n\n\n\n
5.1 Use both as environment variables<\/h2>\n\n\n
apiVersion<\/span>: v1<\/span>\nkind<\/span>: Pod<\/span>\nmetadata<\/span>:\n  name<\/span>: cm-secret-env-demo<\/span>\n  namespace<\/span>: cm-secret-lab<\/span>\nspec<\/span>:\n  containers<\/span>:\n    -<\/span> name<\/span>: demo<\/span>\n      image<\/span>: busybox<\/span>:1.36<\/span>\n      command<\/span>: [\"sh\"<\/span>, \"-c\"<\/span>, \"env | sort && sleep 3600\"<\/span>]<\/span>\n      env<\/span>:\n        -<\/span> name<\/span>: APP_MODE<\/span>\n          valueFrom<\/span>:\n            configMapKeyRef<\/span>:\n              name<\/span>: app-config<\/span>\n              key<\/span>: APP_MODE<\/span>\n        -<\/span> name<\/span>: DB_PASSWORD<\/span>\n          valueFrom<\/span>:\n            secretKeyRef<\/span>:\n              name<\/span>: app-secret<\/span>\n              key<\/span>: DB_PASSWORD<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Apply:<\/p>\n\n\n
kubectl<\/span> apply<\/span> -f<\/span> pod-env<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Check env:<\/p>\n\n\n
kubectl -n cm-secret-lab logs cm-secret-env-demo | grep -E 'APP_MODE|DB_PASSWORD'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Output:<\/p>\n\n\n
APP_MODE=prod\nDB_PASSWORD=P@ssw0rd!\n<\/code><\/span><\/pre>\n\n\n
Inside the Pod, Kubernetes gives the application the decoded value.<\/p>\n\n\n\n
\n\n\n\n
5.2 Mount both as files<\/h2>\n\n\n
apiVersion: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: cm-secret-volume-demo\n  namespace<\/span>: cm-secret-lab\nspec<\/span>:\n  containers:\n    - name: demo\n      image<\/span>: busybox:1.36<\/span>\n      command<\/span>: [\"sh\"<\/span>, \"-c\"<\/span>, \"ls -R \/etc\/app-config \/etc\/app-secret && sleep 3600\"<\/span>]\n      volumeMounts<\/span>:\n        - name: config-volume\n          mountPath<\/span>: \/etc\/<\/span>app-config\n          readOnly<\/span>: true<\/span>\n        - name: secret-volume\n          mountPath<\/span>: \/etc\/<\/span>app-secret\n          readOnly<\/span>: true<\/span>\n  volumes<\/span>:\n    - name: config-volume\n      configMap<\/span>:\n        name: app-config\n    - name: secret-volume\n      secret<\/span>:\n        secretName: app-secret\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Apply:<\/p>\n\n\n
kubectl<\/span> apply<\/span> -f<\/span> pod-volume<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Read mounted values:<\/p>\n\n\n
kubectl -n cm-secret-lab exec cm-secret-volume-demo -- cat \/etc\/app-config\/APP_MODE\nkubectl -n cm-secret-lab exec cm-secret-volume-demo -- cat \/etc\/app-secret\/DB_PASSWORD\n<\/code><\/span><\/pre>\n\n\n
Output:<\/p>\n\n\n
prod<\/span>\nP<\/span>@ssw0rd<\/span>!\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
For sensitive values, volume mounts are often better than environment variables because env vars can leak through process dumps, debug output, accidental logs, and application diagnostics.<\/p>\n\n\n\n
\n\n\n\n
6. Secret Types<\/h1>\n\n\n\n
Common Kubernetes Secret types:<\/p>\n\n\n\n
Type<\/th>Use<\/th><\/tr><\/thead>
Opaque<\/code><\/td>Generic key-value secrets<\/td><\/tr>
kubernetes.io\/tls<\/code><\/td>TLS certificate and private key<\/td><\/tr>
kubernetes.io\/dockerconfigjson<\/code><\/td>Private container registry credentials<\/td><\/tr>
kubernetes.io\/basic-auth<\/code><\/td>Username\/password<\/td><\/tr>
kubernetes.io\/ssh-auth<\/code><\/td>SSH private key<\/td><\/tr>
kubernetes.io\/service-account-token<\/code><\/td>Legacy service account token Secret<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Example TLS Secret:<\/p>\n\n\n
kubectl -n cm-secret-lab create secret tls my-tls-secret \\\n  --cert=tls.crt \\\n  --key=tls.key\n<\/code><\/span><\/pre>\n\n\n
Example Docker registry Secret:<\/p>\n\n\n
kubectl -n cm-secret-lab create secret docker-registry regcred \\\n  --docker-server=index.docker.io \\\n  --docker-username=myuser \\\n  --docker-password=mypassword \\\n  --docker-email=myemail@example.com\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
7. Important Security Reality<\/h1>\n\n\n\n
7.1 Base64 is not encryption<\/h2>\n\n\n\n
This:<\/p>\n\n\n
P<\/span>@ssw0rd<\/span>! -> UEBzc3cwcmQh\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
is reversible without any key:<\/p>\n\n\n
echo<\/span> 'UEBzc3cwcmQh'<\/span> | base64 -d\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
So Kubernetes Secret gives you:<\/p>\n\n\n
API object separation + RBAC + special handling\n<\/code><\/span><\/pre>\n\n\n
It does not automatically give you cryptographic protection<\/strong> in a self-managed upstream cluster unless you configure encryption at rest.<\/p>\n\n\n\n
\n\n\n\n
7.2 Anyone with get secret<\/code> can decode it<\/h2>\n\n\n\n
This RBAC permission is dangerous:<\/p>\n\n\n
resources<\/span>: [\"secrets\"<\/span>]<\/span>\nverbs<\/span>: [\"get\"<\/span>, \"list\"<\/span>, \"watch\"<\/span>]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
A user with get secrets<\/code> can do:<\/p>\n\n\n
kubectl get<\/span> secret app-secret -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Then decode the values.<\/p>\n\n\n\n
For production, give get secrets<\/code> only to tightly controlled service accounts, operators, and administrators.<\/p>\n\n\n\n
\n\n\n\n
8. Kubernetes Native Encryption at Rest<\/h1>\n\n\n\n
Kubernetes supports encryption of API resource data before it is stored in etcd. This is different from base64 encoding. Native encryption protects stored API data such as Secrets in etcd; it does not encrypt files mounted into containers or data inside application volumes. (Kubernetes<\/a>)<\/p>\n\n\n\n
Kubernetes supports KMS provider-based encryption. In Kubernetes 1.36, KMS v2<\/strong> is the recommended approach where feasible; KMS v1 has been deprecated since Kubernetes 1.28 and disabled by default since Kubernetes 1.29<\/strong>. (Kubernetes<\/a>)<\/p>\n\n\n\n
\n\n\n\n
8.1 Self-managed cluster: basic encryption with aescbc<\/code><\/h2>\n\n\n\n
Generate a 32-byte key:<\/p>\n\n\n
head -c 32 \/dev\/urandom | base64\n<\/code><\/span><\/pre>\n\n\n
Example output:<\/p>\n\n\n
qAj0N9HjJxWkKpE4Vg1u7W8dKJmYj9w2vN0bQ9xJx2A=\n<\/code><\/span><\/pre>\n\n\n
Create an encryption config file on every control-plane node:<\/p>\n\n\n
apiVersion: apiserver.config.k8s.io\/v1\nkind: EncryptionConfiguration\nresources:\n  - resources:\n      - secrets\n    providers:\n      - aescbc:\n          keys:\n            - name: key1\n              secret: qAj0N9HjJxWkKpE4Vg1u7W8dKJmYj9w2vN0bQ9xJx2A=\n      - identity: {}\n<\/code><\/span><\/pre>\n\n\n
Save as:<\/p>\n\n\n
\/etc\/kubernetes\/encryption-config.yaml\n<\/code><\/span><\/pre>\n\n\n
Then configure the API server with:<\/p>\n\n\n
--encryption-provider-config=\/etc\/<\/span>kubernetes\/encryption-config.yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
For kubeadm-style static Pods, this usually means editing:<\/p>\n\n\n
\/etc\/kubernetes\/manifests\/kube-apiserver.yaml\n<\/code><\/span><\/pre>\n\n\n
Add volume mount:<\/p>\n\n\n
- --encryption-provider-config=\/etc\/<\/span>kubernetes\/encryption-config.yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
And mount file:<\/p>\n\n\n
volumeMounts:\n  - name: encryption-config\n    mountPath<\/span>: \/etc\/<\/span>kubernetes\/encryption-config.yaml\n    readOnly<\/span>: true<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n
volumes:\n  - name: encryption-config\n    hostPath<\/span>:\n      path: \/etc\/<\/span>kubernetes\/encryption-config.yaml\n      type<\/span>: File\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
After the API server restarts, new Secrets are encrypted before being written to etcd.<\/p>\n\n\n\n
\n\n\n\n
8.2 Re-encrypt existing Secrets<\/h2>\n\n\n\n
After enabling encryption, existing Secrets are not always rewritten automatically in self-managed clusters. Force rewrite:<\/p>\n\n\n
kubectl get<\/span> secrets --all-namespaces -o json | kubectl replace -f -\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
For ConfigMaps too, if you configured encryption for ConfigMaps:<\/p>\n\n\n
kubectl get<\/span> configmaps --all-namespaces -o json | kubectl replace -f -\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
8.3 Decryption with native Kubernetes encryption<\/h2>\n\n\n\n
Normally, you do not<\/strong> manually decrypt etcd values. The flow is:<\/p>\n\n\n
Client -> kube-apiserver -> decrypts from<\/span> etcd -> returns normal Kubernetes API object\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
So this still works:<\/p>\n\n\n
kubectl get<\/span> secret app-secret -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
The API server decrypts the stored data, then returns the Kubernetes Secret object with base64-encoded data<\/code>.<\/p>\n\n\n\n
For disaster recovery, you must keep the encryption config or KMS key available. If you lose the encryption key, encrypted etcd data may become unrecoverable.<\/p>\n\n\n\n
\n\n\n\n
9. External Encrypt \/ Decrypt Options<\/h1>\n\n\n\n
For production, you normally combine multiple layers:<\/p>\n\n\n
Git encryption + Kubernetes RBAC + etcd encryption + cloud KMS + runtime secret delivery\n<\/code><\/span><\/pre>\n\n\n
9.1 SOPS \u2014 best for GitOps encrypted YAML<\/h2>\n\n\n\n
SOPS encrypts YAML, JSON, ENV, INI, and binary files and supports AWS KMS, GCP KMS, Azure Key Vault, age, and PGP. It keeps the file structure visible while encrypting sensitive values. (GitHub<\/a>)<\/p>\n\n\n\n
Install tools<\/h3>\n\n\n
brew install sops age\n<\/code><\/span><\/pre>\n\n\n
Generate age key:<\/p>\n\n\n
age-keygen<\/span> -o<\/span> age<\/span>.key<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Show public recipient:<\/p>\n\n\n
grep<\/span> public<\/span> age<\/span>.key<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Example:<\/p>\n\n\n
# public key: age1abcxyz...<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Create .sops.yaml<\/code>:<\/p>\n\n\n
creation_rules:\n  - path_regex: .*secret.*\\.yaml$\n    age: age1abcxyz...\n<\/code><\/span><\/pre>\n\n\n
Create Secret manifest:<\/p>\n\n\n
apiVersion<\/span>: v1<\/span>\nkind<\/span>: Secret<\/span>\nmetadata<\/span>:\n  name<\/span>: app-secret<\/span>\n  namespace<\/span>: cm-secret-lab<\/span>\ntype<\/span>: Opaque<\/span>\nstringData<\/span>:\n  DB_PASSWORD<\/span>: P<\/span>@ssw0rd<\/span>!\n  API_KEY:<\/span> abc123\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Encrypt:<\/p>\n\n\n
sops<\/span> --encrypt<\/span> app-secret<\/span>.yaml<\/span> > app-secret<\/span>.enc<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Decrypt:<\/p>\n\n\n
SOPS_AGE_KEY_FILE=age.key sops --decrypt app-secret.enc.yaml\n<\/code><\/span><\/pre>\n\n\n
Apply without saving decrypted file:<\/p>\n\n\n
SOPS_AGE_KEY_FILE=age.key sops --decrypt app-secret.enc.yaml | kubectl apply -f -\n<\/code><\/span><\/pre>\n\n\n
Good for:<\/p>\n\n\n
GitOps + Argo CD + Flux + CI\/CD\n<\/code><\/span><\/pre>\n\n\n
Risk:<\/p>\n\n\n
CI\/CD runner needs decrypt permission.\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
9.2 Sealed Secrets \u2014 encrypt Secret for one cluster<\/h2>\n\n\n\n
Bitnami Sealed Secrets lets you encrypt a Kubernetes Secret into a SealedSecret<\/code>; only the controller running in the target cluster can decrypt it. It is designed for safely storing encrypted Secrets in Git. (GitHub<\/a>)<\/p>\n\n\n\n
Install controller:<\/p>\n\n\n
helm repo add sealed-secrets https:\/\/bitnami-labs.github.io\/sealed-secrets<\/span>\nhelm repo update\n\nhelm install sealed-secrets sealed-secrets\/sealed-secrets \\\n  -n kube-system\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Create a normal Secret manifest locally, then seal it:<\/p>\n\n\n
kubectl -n cm-secret-lab create secret generic app-secret \\\n  --from<\/span>-literal=DB_PASSWORD='P@ssw0rd!'<\/span> \\\n  --dry-run=client \\\n  -o yaml \\\n  | kubeseal --format yaml > app-secret-sealed.yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Apply sealed secret:<\/p>\n\n\n
kubectl<\/span> apply<\/span> -f<\/span> app-secret-sealed<\/span>.yaml<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
The cluster controller decrypts it and creates a normal Kubernetes Secret.<\/p>\n\n\n\n
Good for:<\/p>\n\n\n
GitOps where encrypted Secret is bound to a cluster.\n<\/code><\/span><\/pre>\n\n\n
Risk:<\/p>\n\n\n
If<\/span> controller private<\/span> key is lost, old SealedSecrets cannot be decrypted.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
9.3 External Secrets Operator \u2014 sync from real secret managers<\/h2>\n\n\n\n
External Secrets Operator synchronizes secrets from external secret systems such as AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, and Azure Key Vault into Kubernetes Secrets. (External Secrets<\/a>)<\/p>\n\n\n\n
Install:<\/p>\n\n\n
helm repo add external-secrets https:\/\/charts.external-secrets.io<\/span>\nhelm repo update\n\nhelm install external-secrets external-secrets\/external-secrets \\\n  -n external-secrets \\\n  --create-namespace \\\n  --set<\/span> installCRDs=true\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Example ExternalSecret<\/code>:<\/p>\n\n\n
apiVersion: external-secrets.io\/v1\nkind: ExternalSecret\nmetadata:\n  name: app-secret\n  namespace<\/span>: cm<\/span>-secret<\/span>-lab<\/span>\nspec<\/span>:\n  refreshInterval<\/span>: 1h<\/span>\n  secretStoreRef<\/span>:\n    name<\/span>: cloud<\/span>-secret<\/span>-store<\/span>\n    kind<\/span>: SecretStore<\/span>\n  target<\/span>:\n    name<\/span>: app<\/span>-secret<\/span>\n    creationPolicy<\/span>: Owner<\/span>\n  data<\/span>:\n    - secretKey<\/span>: DB_PASSWORD<\/span>\n      remoteRef<\/span>:\n        key<\/span>: prod<\/span>\/app<\/span>\/db<\/span>\n        property<\/span>: password<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Good for:<\/p>\n\n\n
Central secret manager + rotation + audit + multi-cluster usage\n<\/code><\/span><\/pre>\n\n\n
Risk:<\/p>\n\n\n
By default<\/span>, it still creates a native Kubernetes Secret unless you design otherwise.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
9.4 Secrets Store CSI Driver \u2014 mount external secrets as files<\/h2>\n\n\n\n
The Secrets Store CSI Driver lets Kubernetes mount secrets, keys, and certificates from enterprise secret stores into Pods as volumes. Once attached, the secret data is mounted into the container filesystem. (Secrets Store CSI Driver<\/a>)<\/p>\n\n\n\n
Typical pattern:<\/p>\n\n\n
External Secret Store -> CSI Driver -> Pod volume\n<\/code><\/span><\/pre>\n\n\n
Example Pod volume shape:<\/p>\n\n\n
volumes<\/span>:\n  -<\/span> name<\/span>: secrets-store-inline<\/span>\n    csi<\/span>:\n      driver<\/span>: secrets-store<\/span>.csi<\/span>.k8s<\/span>.io<\/span>\n      readOnly<\/span>: true<\/span>\n      volumeAttributes<\/span>:\n        secretProviderClass<\/span>: app-secret-provider<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Good for:<\/p>\n\n\n
Avoiding persistent Kubernetes Secret objects.\n<\/code><\/span><\/pre>\n\n\n
Risk:<\/p>\n\n\n
Application must read secrets from<\/span> files, not env vars.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
9.5 HashiCorp Vault Agent Injector<\/h2>\n\n\n\n
Vault Agent Injector is a Kubernetes admission webhook that injects Vault Agent containers into Pods so workloads can consume Vault secrets. It commonly authenticates using the Pod\u2019s Kubernetes service account. (HashiCorp Developer<\/a>)<\/p>\n\n\n\n
Example annotation style:<\/p>\n\n\n
metadata:\n  annotations:\n    vault.hashicorp.com\/agent-inject: \"true\"<\/span>\n    vault.hashicorp.com\/role: \"myapp\"<\/span>\n    vault.hashicorp.com\/agent-inject-secret-db-password: \"secret\/data\/prod\/db\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Good for:<\/p>\n\n\n
Dynamic credentials, short-lived database passwords, strict audit.\n<\/code><\/span><\/pre>\n\n\n
Risk:<\/p>\n\n\n
Needs Vault availability and correct auth\/policy design.\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
10. Cloud Provider Improvements<\/h1>\n\n\n\n
Modern managed Kubernetes platforms improve Secrets in four major ways:<\/p>\n\n\n
1.<\/span> Managed control-plane encryption\n2.<\/span> Cloud KMS integration\n3.<\/span> Cloud-native secret stores\n4.<\/span> Workload identity \/ IAM-based access instead of<\/span> static<\/span> credentials\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
11. EKS \u2014 Amazon Elastic Kubernetes Service<\/h1>\n\n\n\n
11.1 EKS secret encryption status<\/h2>\n\n\n\n
Amazon EKS now uses KMS v2 default envelope encryption for all Kubernetes API data<\/strong> in managed control planes for clusters running Kubernetes 1.28 or higher<\/strong>. For EKS clusters running Kubernetes 1.27 or lower<\/strong>, the older procedure to enable Secrets encryption with AWS KMS applies. (AWS Documentation<\/a>)<\/p>\n\n\n\n
AWS recommends using AWS KMS for envelope encryption of Kubernetes Secrets. In that model, a data encryption key encrypts the data, and the data encryption key is encrypted by a key encryption key in AWS KMS. (AWS Documentation<\/a>)<\/p>\n\n\n\n
\n\n\n\n
11.2 EKS old clusters: enable KMS encryption<\/h2>\n\n\n\n
For EKS Kubernetes 1.27 or lower:<\/p>\n\n\n
aws eks associate-encryption-config \\\n  --cluster-name my-cluster \\\n  --encryption-config '[{\"resources\":[\"secrets\"],\"provider\":{\"keyArn\":\"arn:aws:kms:ap-northeast-1:111122223333:key\/abcd-1234\"}}]'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Using eksctl<\/code>:<\/p>\n\n\n
eksctl utils enable-secrets-encryption \\\n  --cluster my-cluster \\\n  --key-arn arn:aws:kms:ap-northeast-1:111122223333:key\/abcd-1234\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
11.3 EKS with AWS Secrets Manager using External Secrets Operator<\/h2>\n\n\n\n
Use IAM Roles for Service Accounts or EKS Pod Identity so the External Secrets Operator can read AWS Secrets Manager without static AWS keys.<\/p>\n\n\n\n
Example ClusterSecretStore<\/code> shape:<\/p>\n\n\n
apiVersion: external-secrets.io\/v1\nkind: ClusterSecretStore\nmetadata:\n  name: aws-secrets-manager\nspec:\n  provider:\n    aws:\n      service: SecretsManager\n      region: ap-northeast-1<\/span>\n      auth:\n        jwt:\n          serviceAccountRef:\n            name: external-secrets\n            namespace<\/span>: external<\/span>-secrets<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Example app secret:<\/p>\n\n\n
apiVersion: external-secrets.io\/v1\nkind: ExternalSecret\nmetadata:\n  name: app-secret\n  namespace<\/span>: cm<\/span>-secret<\/span>-lab<\/span>\nspec<\/span>:\n  refreshInterval<\/span>: 1h<\/span>\n  secretStoreRef<\/span>:\n    name<\/span>: aws<\/span>-secrets<\/span>-manager<\/span>\n    kind<\/span>: ClusterSecretStore<\/span>\n  target<\/span>:\n    name<\/span>: app<\/span>-secret<\/span>\n  data<\/span>:\n    - secretKey<\/span>: DB_PASSWORD<\/span>\n      remoteRef<\/span>:\n        key<\/span>: prod<\/span>\/app<\/span>\/db<\/span>\n        property<\/span>: password<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Best EKS production pattern:<\/p>\n\n\n
AWS Secrets Manager \/ SSM Parameter Store\n+ IAM Roles for<\/span> Service Accounts or EKS Pod Identity\n+ External Secrets Operator or AWS Secrets Store CSI provider\n+ EKS default<\/span> KMS v2 envelope encryption\n+ strict Kubernetes RBAC\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
12. AKS \u2014 Azure Kubernetes Service<\/h1>\n\n\n\n
12.1 AKS secret encryption status<\/h2>\n\n\n\n
AKS stores Kubernetes Secrets in etcd and supports optional KMS provider encryption using Azure Key Vault. Azure describes this as an additional KMS provider layer over platform encryption, where Secrets stored in etcd can be encrypted using Azure Key Vault keys. (Azure Documentation<\/a>)<\/p>\n\n\n\n
Microsoft\u2019s AKS KMS documentation shows how to enable encryption at rest using Azure Key Vault and the Kubernetes KMS plugin, including bring-your-own-key and key rotation scenarios. (Microsoft Learn<\/a>)<\/p>\n\n\n\n
\n\n\n\n
12.2 Enable AKS KMS encryption with Azure Key Vault<\/h2>\n\n\n\n
Create or use an Azure Key Vault key, then create AKS with KMS:<\/p>\n\n\n
az aks create \\\n  --name myAKSCluster \\\n  --resource-group myResourceGroup \\\n  --assign-identity \"$IDENTITY_RESOURCE_ID\"<\/span> \\\n  --enable-azure-keyvault-kms \\\n  --azure-keyvault-kms-key-vault-network-access \"Public\"<\/span> \\\n  --azure-keyvault-kms-key-id \"$KEY_ID\"<\/span> \\\n  --generate-ssh-keys\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Enable on an existing cluster:<\/p>\n\n\n
az aks update \\\n  --name myAKSCluster \\\n  --resource-group myResourceGroup \\\n  --enable-azure-keyvault-kms \\\n  --azure-keyvault-kms-key-vault-network-access \"Public\"<\/span> \\\n  --azure-keyvault-kms-key-id \"$KEY_ID\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
For private Key Vault:<\/p>\n\n\n
az aks update \\\n  --name myAKSCluster \\\n  --resource-group myResourceGroup \\\n  --enable-azure-keyvault-kms \\\n  --azure-keyvault-kms-key-id \"$KEY_ID\"<\/span> \\\n  --azure-keyvault-kms-key-vault-network-access \"Private\"<\/span> \\\n  --azure-keyvault-kms-key-vault-resource-id \"$KEY_VAULT_RESOURCE_ID\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
12.3 AKS with Azure Key Vault Provider for Secrets Store CSI Driver<\/h2>\n\n\n\n
AKS has a managed add-on for Azure Key Vault Provider for Secrets Store CSI Driver. Microsoft documents enabling it with --enable-addons azure-keyvault-secrets-provider<\/code>; the add-on creates a user-assigned managed identity for Key Vault access. (Microsoft Learn<\/a>)<\/p>\n\n\n\n
Enable during cluster creation:<\/p>\n\n\n
az aks create \\\n  --resource-group myResourceGroup \\\n  --name myAKSCluster \\\n  --enable-addons azure-keyvault-secrets-provider \\\n  --enable-oidc-issuer \\\n  --enable-workload-identity \\\n  --generate-ssh-keys\n<\/code><\/span><\/pre>\n\n\n
Enable on existing cluster:<\/p>\n\n\n
az aks enable-addons \\\n  --addons azure-keyvault-secrets-provider \\\n  --name myAKSCluster \\\n  --resource-group myResourceGroup\n<\/code><\/span><\/pre>\n\n\n
Best AKS production pattern:<\/p>\n\n\n
Azure Key Vault\n+ AKS Workload Identity\n+ Secrets Store CSI Driver or External Secrets Operator\n+ AKS KMS etcd encryption\n+ Azure RBAC \/ Kubernetes RBAC\n+ Key Vault soft delete<\/span> + purge protection\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
13. GKE \/ \u201cGKS\u201d \u2014 Google Kubernetes Engine<\/h1>\n\n\n\n
I\u2019m assuming by GKS<\/strong> you mean GKE<\/strong>, Google Kubernetes Engine.<\/p>\n\n\n\n
13.1 GKE secret encryption status<\/h2>\n\n\n\n
Google Cloud encrypts data at rest by default, including GKE data, but GKE also supports application-layer Secrets encryption<\/strong> using a customer-managed key in Cloud KMS. Google\u2019s current GKE documentation describes encrypting Kubernetes Secrets at the application layer with a Cloud KMS key that you manage. (Google Cloud<\/a>)<\/p>\n\n\n\n
\n\n\n\n
13.2 Create GKE cluster with Cloud KMS application-layer Secrets encryption<\/h2>\n\n\n\n
Create KMS key ring and key:<\/p>\n\n\n
gcloud kms keyrings create gke-secrets-ring \\\n  --location=global<\/span>\n\ngcloud kms keys create gke-secrets-key \\\n  --location=global<\/span> \\\n  --keyring=gke-secrets-ring \\\n  --purpose=encryption\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Grant GKE service account access to the key:<\/p>\n\n\n
gcloud kms keys add-iam-policy-binding gke-secrets-key \\\n  --location=global<\/span> \\\n  --keyring=gke-secrets-ring \\\n  --member=\"serviceAccount:SERVICE_ACCOUNT_EMAIL\"<\/span> \\\n  --role=\"roles\/cloudkms.cryptoKeyEncrypterDecrypter\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Create cluster:<\/p>\n\n\n
gcloud container clusters create my-gke-cluster \\\n  --region=asia-northeast1 \\\n  --database-encryption-key=projects\/PROJECT_ID\/locations\/global<\/span>\/keyRings\/gke-secrets-ring\/cryptoKeys\/gke-secrets-key\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Update existing cluster:<\/p>\n\n\n
gcloud container clusters update my-gke-cluster \\\n  --region=asia-northeast1 \\\n  --database-encryption-key=projects\/PROJECT_ID\/locations\/global<\/span>\/keyRings\/gke-secrets-ring\/cryptoKeys\/gke-secrets-key\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
13.3 GKE with Google Secret Manager<\/h2>\n\n\n\n
Recommended pattern:<\/p>\n\n\n
Google Secret Manager\n+ Workload Identity Federation for GKE\n+ External Secrets Operator or Secrets Store CSI Driver provider\n+ Cloud KMS application-layer Secrets encryption\n+ Kubernetes RBAC\n<\/code><\/span><\/pre>\n\n\n
Example External Secret concept:<\/p>\n\n\n
apiVersion: external-secrets.io\/v1\nkind: ExternalSecret\nmetadata:\n  name: app-secret\n  namespace<\/span>: cm<\/span>-secret<\/span>-lab<\/span>\nspec<\/span>:\n  refreshInterval<\/span>: 1h<\/span>\n  secretStoreRef<\/span>:\n    name<\/span>: google<\/span>-secret<\/span>-manager<\/span>\n    kind<\/span>: ClusterSecretStore<\/span>\n  target<\/span>:\n    name<\/span>: app<\/span>-secret<\/span>\n  data<\/span>:\n    - secretKey<\/span>: DB_PASSWORD<\/span>\n      remoteRef<\/span>:\n        key<\/span>: prod<\/span>-app<\/span>-db<\/span>-password<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Best GKE production pattern:<\/p>\n\n\n
Google Secret Manager\n+ GKE Workload Identity\n+ Cloud KMS application-layer secret encryption\n+ External Secrets Operator or CSI mount\n+ Binary Authorization \/ Policy Controller for guardrails\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
14. OpenShift<\/h1>\n\n\n\n
14.1 OpenShift secret encryption status<\/h2>\n\n\n\n
In OpenShift Container Platform 4.19 documentation, Red Hat states that etcd data is not encrypted by default<\/strong>. When etcd encryption is enabled, OpenShift encrypts resources including Secrets, ConfigMaps, Routes, OAuth access tokens, and OAuth authorize tokens<\/strong>. The docs also note that encryption protects values, not keys; resource types, namespaces, and object names remain unencrypted. (Red Hat Documentation<\/a>)<\/p>\n\n\n\n
\n\n\n\n
14.2 Enable etcd encryption in OpenShift<\/h2>\n\n\n\n
Check current setting:<\/p>\n\n\n
oc get<\/span> apiserver cluster -o yaml\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Enable encryption:<\/p>\n\n\n
oc patch apiserver cluster \\\n  --type=merge \\\n  -p '{\"spec\":{\"encryption\":{\"type\":\"aescbc\"}}}'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Watch progress:<\/p>\n\n\n
oc get<\/span> clusteroperators kube-apiserver openshift-apiserver authentication\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Check API server status:<\/p>\n\n\n
oc get apiserver cluster -o jsonpath='{.status.conditions}'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Depending on OpenShift version, supported encryption types can include AES-CBC and AES-GCM. Always confirm the exact supported values for your OpenShift release before changing production clusters.<\/p>\n\n\n\n
\n\n\n\n
14.3 OpenShift External Secrets Operator<\/h2>\n\n\n\n
Red Hat provides an External Secrets Operator for OpenShift. It fetches secrets from external providers including AWS Secrets Manager, HashiCorp Vault, Google Secret Manager, Azure Key Vault, IBM Cloud Secrets Manager, and AWS Systems Manager Parameter Store. (Red Hat Documentation<\/a>)<\/p>\n\n\n\n
Production pattern:<\/p>\n\n\n
External provider\n-> External Secrets Operator\n-> Kubernetes Secret\n-> Application\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
14.4 OpenShift Secrets Store CSI Driver<\/h2>\n\n\n\n
OpenShift \/ OKD documentation describes the Secrets Store CSI Driver Operator as a way to mount secrets, keys, and certificates from external secret stores into Pods as volumes. Listed providers include AWS Secrets Manager, AWS Systems Manager Parameter Store, Azure Key Vault, and HashiCorp Vault. (OKD Documentation<\/a>)<\/p>\n\n\n\n
Production pattern:<\/p>\n\n\n
External secret manager\n-> CSI driver\n-> Pod volume\n<\/code><\/span><\/pre>\n\n\n
This is useful when you do not want the secret value persisted as a normal Kubernetes Secret.<\/p>\n\n\n\n
Best OpenShift production pattern:<\/p>\n\n\n
OpenShift etcd encryption\n+ External Secrets Operator or Secrets Store CSI Driver\n+ Vault \/ AWS Secrets Manager \/ Azure Key Vault \/ Google Secret Manager\n+ strict OpenShift RBAC\n+ SCC \/ admission policy\n+ audit logging\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
15. Best Practice Architecture by Security Level<\/h1>\n\n\n\n
Level 1 \u2014 Basic lab<\/h2>\n\n\n
ConfigMap for config\nSecret for password\nRBAC limited\n<\/code><\/span><\/pre>\n\n\n
Good for learning, not enough for production.<\/p>\n\n\n\n
\n\n\n\n
Level 2 \u2014 Standard production<\/h2>\n\n\n
ConfigMap for<\/span> non-sensitive config\nSecret for<\/span> sensitive values\netcd encryption enabled\nRBAC restricted\nSecrets mounted as<\/span> files where possible\nAudit logging enabled\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
Level 3 \u2014 GitOps production<\/h2>\n\n\n
SOPS or Sealed Secrets\nGit stores only encrypted secret manifests\nCI\/CD decrypts or controller decrypts\nCluster has etcd encryption\nRBAC restricted\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
Level 4 \u2014 Enterprise cloud-native<\/h2>\n\n\n
AWS Secrets Manager \/ Azure Key Vault \/ Google Secret Manager \/ Vault\nExternal Secrets Operator or Secrets Store CSI Driver\nWorkload identity, not static<\/span> cloud keys\nCloud KMS envelope encryption\nSecret rotation\nAudit logging\nPolicy enforcement\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
Level 5 \u2014 High-security \/ regulated<\/h2>\n\n\n
External secret manager is source of truth\nNo long-lived static<\/span> secrets in Git\nNo secrets as<\/span> env vars\nRuntime mount or<\/span> dynamic injection\nShort-lived credentials\nAutomatic rotation\nKMS\/HSM-backed keys\nNamespace<\/span> isolation<\/span>\nDedicated<\/span> service<\/span> accounts<\/span>\nAdmission<\/span> policy<\/span> blocks<\/span> unsafe<\/span> Secrets<\/span>\nFull<\/span> audit<\/span> trail<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
16. Recommended Decision Matrix<\/h1>\n\n\n\n
Requirement<\/th>Best choice<\/th><\/tr><\/thead>
Non-sensitive app config<\/td>ConfigMap<\/td><\/tr>
Password\/API key for simple app<\/td>Secret<\/td><\/tr>
Need encrypted GitOps<\/td>SOPS or Sealed Secrets<\/td><\/tr>
Need central rotation<\/td>External Secrets Operator<\/td><\/tr>
Need avoid native Kubernetes Secret persistence<\/td>Secrets Store CSI Driver<\/td><\/tr>
Need dynamic DB credentials<\/td>HashiCorp Vault<\/td><\/tr>
EKS production<\/td>AWS Secrets Manager + IRSA\/EKS Pod Identity + KMS<\/td><\/tr>
AKS production<\/td>Azure Key Vault + Workload Identity + KMS<\/td><\/tr>
GKE production<\/td>Google Secret Manager + Workload Identity + Cloud KMS<\/td><\/tr>
OpenShift production<\/td>etcd encryption + ESO\/CSI + Vault\/cloud secret manager<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
17. Real Interview \/ Exam Style Summary<\/h1>\n\n\n\n
ConfigMap<\/h2>\n\n\n
ConfigMap stores non-confidential configuration data in key-value form.\nIt is visible in plain text through kubectl.\nUse<\/span> it<\/span> for<\/span> app<\/span> settings<\/span>, URLs<\/span>, flags<\/span>, and<\/span> config<\/span> files<\/span>.\nDo<\/span> not<\/span> store<\/span> passwords<\/span> or<\/span> API<\/span> keys<\/span> in<\/span> ConfigMaps<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Secret<\/h2>\n\n\n
Secret stores confidential data such as<\/span> passwords, tokens, and keys.\nSecret data is base64-encoded, not encrypted by default<\/span>.\nAnyone with<\/span> permission to read the Secret can decode it.\nFor production, enable encryption at rest and use external secret managers where possible.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Encoding vs Encryption<\/h2>\n\n\n
Encoding = reversible format transformation, no key needed.\nEncryption = cryptographic protection, key required.\nKubernetes Secret data uses base64 encoding.\nKubernetes etcd encryption or cloud KMS provides real encryption.\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
18. Cleanup Lab<\/h1>\n\n\n
kubectl delete<\/span> namespace cm-secret-lab\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
19. Final Recommended Production Pattern<\/h1>\n\n\n\n
For modern Kubernetes in 2026, I would use this:<\/p>\n\n\n
ConfigMap:\n  Only non-sensitive app configuration.\n\nSecret:\n  Only when application requires Kubernetes-native Secret.\n\nGit:\n  Never store plain Secret YAML.\n  Use SOPS or Sealed Secrets.\n\nCluster:\n  Enable etcd \/ API data encryption.\n  Use KMS v2 where available.\n\nCloud:\n  Use AWS Secrets Manager, Azure Key Vault, Google Secret Manager, or Vault.\n\nRuntime:\n  Prefer Workload Identity \/ IRSA \/ managed identity.\n  Avoid static<\/span> cloud access keys.\n  Prefer CSI mount or External Secrets Operator.\n  Rotate secrets regularly.\n\nRBAC:\n  Treat \"get secrets\"<\/span> as<\/span> near-admin-level permission.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
The one-line golden rule:<\/p>\n\n\n
ConfigMap is for configuration. Secret is for sensitive data. But Secret is only safe when RBAC, encryption at rest, external secret management, and rotation are designed properly.\n<\/code><\/span><\/pre>\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
As of July 4, 2026, the current stable upstream Kubernetes line is Kubernetes v1.36, with v1.36.2 released on June 9, 2026. Kubernetes v1.37 is in release-cycle\/pre-release status,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-77367","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=77367"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77367\/revisions"}],"predecessor-version":[{"id":77368,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/77367\/revisions\/77368"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=77367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=77367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=77367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Critical warning: do not delete or expire the Key Vault key used for AKS KMS encryption; Microsoft warns that doing so can make the API server unable to work with encrypted data. (Microsoft Learn<\/a>)<\/p>\n\n\n\n