Kubernetes is an open-source container orchestration system mainly used for automated software deployment, management, and scaling. Kubernetes is also known as K8s. Kubernetes was originally developed by Google but it is now being maintained by Cloud Native Computing Foundation. It was originally designed to be interfaced with only Docker runtime but it now works with containers and CRI-O also. The main purpose of Kubernetes is to automate the operational tasks of container management. It is included with built-in commands for the deployment of applications and rolling out the required changes in the application. It is currently being used by companies like Google, Spotify, and capital one.
What Are Kubernetes Secrets?
A secret in Kubernetes can be defined as an object that contains a small quantity of sensitive data like a password, a token, or a key. It contains information that is otherwise stored in a container image or pod specification. The main advantage of a secret is that we will not have to include sensitive or confidential data in the application code. There is less risk of losing or exposing secrete during the workflow of creating viewing, and editing Pods because they can be and are created independently of the pods in which they are being used. Secretes can be considered similar to ConfigMaps but the main difference between them is that they are specially designed to store and hold confidential data.
Uses of Kubernetes Secretes
The following are the uses of Kubernetes Secrets:
- Secrets can be used as a container environment variable.
- As a file in a volume mounted on at least one of its containers.
- It can be used by Kubelet when pulling images from the pod.
- Secretes are also used by the Kubernetes control plane.
Using A Kubernetes Secret
- Secretes can be exposed as environment variables to be used by a container in a Pod or can be mounted as data volumes. It can even be used directly by other parts of the system without being directly exposed to the pods. If we consider an example a secret can store credentials that other parts of the system should use to interact with the external systems at the pace ourselves.
- The secret volume sources are validated to ensure that the specific object's reference actually points to an object of a particular object of secret type. Due to this, the secrete should be created before any pods that depend on it. If the required secrete cannot be fetched due to its non-existence or due to the temporary lack of connection to the AOI server the kubelet periodically retires running that specific Pod. Kubelet also reports the event for that Pod including all the details of the problems fetching the secret.
- When we are defining a container environment variable based on a Secret we can make it optional. The default setting is that a secrete is required. None of the Pod Containers will start working until all the non-optional Secrete are available. That means if a pod references a specific key in a Secrete and it exists but it is missing the name key then the pod fails startup.
Use Case: Dotfiles in a Kubernetes Secret Volume
For increasing the confidentiality of our data we can use dotfiles within the kubernetes secrets. Here the dotfiles are the hidden files that begin filename with ( . ) Ex: .api_key1 , .api_key2. By using these files inside the secrets we can store our sensitive keys and information safely. The following yaml code illustrates clearly.
In this example, the dotfiles .api_key1 and .api_key2 stores the sensitive API keys within api-keys-secret secret. These keys remains hidden and secured when mounted with api-keys-container ensuring only authorized processes can access them.
apiVersion: v1
kind: Secret
metadata:
name: api-keys-secrets
type: Opaque
data:
api_key1: YWJjZGVmZw==
api_key2: ZGVmZ2hpamtsbQ==
---
apiVersion: v1
kind: Pod
metadata:
name: api-keys-pod
spec:
volumes:
- name: secret-volume
secret:
secretName: api-keys-secrets
containers:
- name: api-keys-container
image: registry.k8s.io/busybox
command:
- ls
- "-la"
- "/etc/secret-volume"
volumeMounts:
- name: secret-volume
readOnly: true
mountPath: "/etc/secret-volume"
Use case: Kubernetes Secret Visible to One Container in a Pod
We can enhance the security for the senstive information within a pod by making it visible to only one container that is needed. For example take this secenario they are front and backend applications, front end application container is responsible for user interaction and complex business logic. Other backend application container will handle the message signing responsibility using private key that is stored securely in kubernetes secrets. Here the front end application doesn't have expose to view the private key and see the sensitive data. The following yaml code illustrates it clearly.
apiVersion: v1
kind: Secret
metadata:
name: signing-secret
data:
.private-key: cGFzc3dvcmQ=
---
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
containers:
- name: frontend-container
image: myregistry.io/frontend-app
# Configuration for frontend container...
- name: signer-container
image: myregistry.io/signer-app
command:
- ls
- "-la"
- "/etc/signing"
volumeMounts:
- name: signing-volume
readOnly: true
mountPath: "/etc/signing"
volumes:
- name: signing-volume
secret:
secretName: signing-secret
Types Of Kubernetes Secrets
The following are the types of kubernetes Secrets and Its Usage inshort:
Built-in Type | Usage |
|---|
Opaque | It is used for storing user-defined data |
|---|
k8s.io/service-account-token | It is used for storing ServiceAccount Token |
|---|
k8s.io/dockercfg | It is used for storing serialized ~/.dockercfg file |
|---|
k8s.io/dockerconfigjson | It is used for storing serialized ~/.docker/config.json file |
|---|
k8s.io/basic-auth | It is for storing basic authentication credentials |
|---|
1. Opaque Secrets
- These are the default secret types i.e., if don't specify any type while creating, this Opaque secrets type is used default. It is used for storing general user-defined data values. We have to generic as subcommand to use this type, if want to specify. The following is an empty
- Example: Used for storing API keys or database passwords
- The following command creates a empty secret type Opaque:
kubect create secret generic mysecret
2. ServiceAccount Token Secrets
- This type of secret type is used to identify the serviceAccount It is used for storing credentials that are used by pods to authenitcate with the kubernetes API Server.
- Example: Used for storing Access Tokens for communicating with kubernetes resources.
- The following yaml code illustrates it clearly:
apiVersion: v1
kind: Secret
metadata:
name: sa-token-secret
annotations:
kubernetes.io/service-account.name: "sa-name"
type: kubernetes.io/service-account-token
data:
token: <base64-encoded-token>
3.Docker Config Secrets
- It used for serializing the docker configuration files that are used for authenticating with docker registries.
- Example: Used for storing credentials for accessing private docker repositories.
- The following yaml code helps in you better understanding of docker config secrets:
apiVersion: v1
kind: Secret
metadata:
name: docker-config-secret
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson: <base64-encoded-config-json>
4. Basic Authentication Secrets
- It is used for storing credentials of basic HTTP authentication. The following yaml code illustrates you clearly about creating basic Authentication secrets types with yaml code:
- Example: It is used for storing Username and Password for accesing a web service.
apiVersion: v1
kind: Secret
metadata:
name: ssh-auth-secret
type: kubernetes.io/ssh-auth
data:
ssh-privatekey: UG91cmluZzYlRW1vdGljb24lU2N1YmE= # base64 encoded private key
5. SSH Authentication Secrets
- It is used for storing credentials for SSH Authentication.The following yaml code helps you in better understanding the ssh Authentication secrets creation.
- Example: Used for storing Username and passwords for accessing a web service.
apiVersion: v1
kind: Secret
metadata:
name: ssh-auth-secret
type: kubernetes.io/ssh-auth
data:
ssh-privatekey: UG91cmluZzYlRW1vdGljb24lU2N1YmE= # base64 encoded private key
6. TLS Secrets
- It is used for storing data that is used for TLS encryption and decryption. The following yaml code helps you in better understanding of creating TLS secrets type:
- Example: Stores TLS certificates and keys for securing communication between services.
apiVersion: v1
kind: Secret
metadata:
name: tls-secret
type: kubernetes.io/tls
data:
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNVakNDQWJzQ0FnMytNQTBHQ1NxR1NJYjNE
# base64 encoded certificate
tls.key: RXhhbXBsZSBkYXRhIGZvciB0aGUgVExTIGNydCBmaWVsZA== # base64 encoded private key
7. BootStrap Token Secrets
- This secret type is used for storing tokens that are used during the node bootstrap process to sign. The following yaml code helps in understanding and creating the bootstrap token secrets:
apiVersion: v1
kind: Secret
metadata:
name: tls-secret
type: kubernetes.io/tls
data:
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNVakNDQWJzQ0FnMytNQTBHQ1NxR1NJYjNE
# base64 encoded certificate
tls.key: RXhhbXBsZSBkYXRhIGZvciB0aGUgVExTIGNydCBmaWVsZA== # base64 encoded private key
Ways To Create Kubernetes Secrets
When we working with kubernetes, the management of passwords, tokens and certificaties are important. Kubernetes comes up with multi mode of solutions for securly store and access the data. Here, lets discuss the 3 general methods for creating kubernetes secrets.
1. Create kubernetes secrets using kubectl
2. Create kubernetes secrets using A manifest file
3. Create kubernetes secrets using A Generator like Kustomize
Creating Kubernetes Secrets Using Kubectl
- It is a quick and straightforward way of creating kubernetes secrets from command line. It is suitable for creating secrets on the fly during development or testing phases.
- In this secrets creation, it supports accessing data from literals, files offering flexibility of handling sensitive data. The following command is used for creating secrets with string literals:
kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=secretpassword
- The following command is used for creating secrets from one or more files:
kubectl create secret generic my-secret --from-file=ssh-privatekey=~/.ssh/id_rsa
Create Kubernetes Secrets Using A Manifest File
- It comes with facilitating a declarative way of defining secrets using YAML or JSON manifest files. It facilitates with easy sharing and replication of secrets configurations on different environments.
- The following is the simple Yaml file for creating kubernetes secrets.
apiVersion: v1
kind: Secret
metadata:
name: my-secret
type: Opaque
data:
username: YWRtaW4= # base64 encoded username
password: cGFzc3dvcmQ= # base64 encoded password
- After the saving the above file code as mysecret-file.yaml execute the file and create secrets using following command:
kubectl apply -f mysecret-file.yaml
Create Kubernetes Secrets Using A Generator Like Kustomize
- This type of method supports seamless integration with Kustomize ( a K8s native configuration management tool ). It facilitates with generating and customizing secrets dynamically based on overlays or patches.
- It offers enhanced flexibility and scalability for managing complex secret configurations across mutliple developments.
apiVersion: v1
kind: Secret
metadata:
name: my-secret
type: Opaque
data:
api-key: <base64-encoded-api-key>
- After saving the above code file as base-secret.yaml and then execute it with following command:
kustomize build overlays/ | kubectl apply -f -
Kubernetes Secrets vs Configmap
The following are the differences between Kubernetes Secrets and Kubernetes Configmap:
Features | Kubernetes Secrets | Kubernetes ConfigMaps |
|---|
Data Senstivity | It is used for storing senstive data such as passwords, tokens and certificates | It is suitable for storing non-senstive configuration data like application settings, environment variables and configuration files. |
|---|
Data Encoding | The data stored in it, is encoded in base64 for having basic security. But its not encryption. | Here the data is stored in plain text without any encoding or encryption. |
|---|
Access Control | It supports RBAC (Role Based Access Control ) for fine grained access control. | Here the access control is limited to namespace-level with controlablility. |
|---|
Use Cases | It is used for storing sensitive and confidential data that is required to store in applications (running pods.) | It is used for storing configuration data that needed to expose for pods as environmental variables or as mounted files. |
|---|
Data Storage | It stores the data securly within the kubernetes cluster. | It stores Alongside of kubernetes resources within the etcd data store. |
|---|
Kubernetes Secrets Vs Vault
The following are the difference between Kubernetes Secrets and Vault:
Features | Kubernetes Secrets | Vault |
|---|
Data Sensitivity | It is used for storing basic senstive data such as passwords, tokens but it lacks advanced security features. | It is used for storing critical and high sensitive data with advanced encryption and acess control mechanisms. |
|---|
Encryption | It uses base64 encoding for providing basic security but lacks encryption for data at rest | It provides strong encryption mechanisms for data at rest and in transist, It uses AES-256 encryption and transist encryption. |
|---|
Access Control | It provides the access control limiting with RBAC( Role Based Access Control ) | It offers fine-grained access control policies, LDAP inegration and identity based access management. |
|---|
Dynamic Secrets | It doesn't support natively dynamic secrets management and generation. | It supports dynamic secret generation and management enhancing security by reducing the exposure of long-lived secrets. |
|---|
Integration | It provides integration for kubernetes for basic secret management within the cluster. | It provides seamless integration with kubernetes for cerntralized management across the clusters and environments. |
|---|
How to Manage Kubernetes Secrets?
Management of kubernetes secrets involves steps for securly handing sensitive data within the kubernetes cluster. Some of the managing kubernetes secrets are discussed as follows:
- Creation: On using kubectl commands create secrets for storing sentive data such as passwords, tokens or certificates.
- Access Control: Implement Role Based Access Control ( RBAC ) to restrict the access of secrets based on users.
- Encryption: Consider on using external solutions like Hashicorp Vault for enhancing security of secret data at rest and in transist.
- Rotation: Regularly rotating the secrets helps in minimizing the risk of unauthorization and maintaining the security policies.
To know more about this, refer this - Article
How to Use Kubernetes Secrets as Files In Containers?
On using Kubernetes secrets as files we can provide a convenient way of securly accessing sensitive data within pods. The following are some of the uses of kubernetes secrets as files in containers:
- Mounting Secrets: Mount the secrets as volumes or individual files in a pod containers using volume mounts or environment variables.
- Files Access: Try on accessing the secret data within containers as files from specific directories or as environment variables.
- Security: Ensure to maintain proper permissions and access controls that are configured to restrict access of secret files within containers.
- Integration: The seamless integration of secret files into the application workflows facilitates secure retrival and utilization of sensitive information during runtime.
To know more about this, refer this - Article
Working With Kubernetes
Working with kubernetes involves better understanding of its core concepts and effective management of resources within the cluster. The following are some of the points suggested for working with kubernetes:
- Resource Management: We can deploy and manage the resources such as Pods, deployments, services and other resources using declarative YAML manifests or using imperative kubectl commands.
- Scaling: The scaling of applications horizantally or vertically to meet the changes as per demand can be done using k8s scaling features such asHorizontal Pod Autoscaler (HPA) or Vertical Pod Autoscaler ( VPA ).
- Monitoring: On monitoring the resource utilization, cluster health and application performance with the help of bult-in kubernetes monitoring tools or third party solutions.
- Maintenance: Try on performing routine maintenance tasks such as upgrades, patches and backups for ensuring stability, reliability of kubernetes cluster.
To know more about this, refer this - Article
Alternatives to Kubernetes Secrets
If there is a need to protect your data then Secrete is not the only option available. There are some other alternatives available.
- We can use ServiceAccount and its tokens to identify the cluster if the cloud native component has the need for authentication to another application that is also running within the same Kubernetes Cluster.
- We can use third-party tools that can be run by us either outside or from within the cluster that provides secrets management.
- If we need authentication we can implement a custom signer for X.509 certificates and then use CertificateSigningRequests to let that custom signer issue certificates to Pods that required them.
- We can use a device plugin to expose node local encryption hardware to a specific Pod.
There is no compulsion to use only services or one of these options. We can even combine two or more options based on our requirements.
Similar Reads
Kubernetes Tutorial Kubernetes is an open-source container management platform that automates the deployment, management, and scaling of container-based applications in different kinds of environments like physical, virtual, and cloud-native computing foundations. In this Kubernetes Tutorial, you are going to learn all
8 min read
Introduction to Kubernetes
Installation and Setup
Application Deployment
What are Kubernetes Containers?Kubernetes is an open-source container orchestration framework that was originally developed by Google. Container orchestration is automation. It can facilitate you to deploy the identical application across different environments like physical machines, virtual machines cloud environments, or perha
15 min read
Kubernetes - Introduction to Container OrchestrationIn this article, we will look into Container Orchestration in Kubernetes. But first, let's explore the trends that gave rise to containers, the need for container orchestration, and how that it has created the space for Kubernetes to rise to dominance and growth. The growth of technology into every
4 min read
Kubernetes - ImagesPre-requisite:- Kubernetes A container image is used to represent binary data that is being used to encapsulate an application and all its software dependencies. Container images can be represented as executable software bundles that run standalone and make very defined assumptions about their runti
3 min read
Kubernetes - JobsPre-requisite: Kubernetes In the Kubernetes world, jobs are considered an object to act as a supervisor or controllers of a task. The Kubernetes job will create a pod, monitor the task, and recreate another one if that pod fails for some reason. Upon completion of the task, it will terminate the pod
4 min read
Kubernetes - Labels & SelectorsAn open-source container management platform called Kubernetes automates the deployment, scaling, descaling, and load balancing of containers (also called a container orchestration tool). It was created by Google in Golang and has a sizable community as a result of that. Google eventually donated it
5 min read
Kubernetes - NamespacesKubernetes Namespace is a mechanism that enables you to organize resources. It is like a virtual cluster inside the cluster. A namespace isolates the resources from the resources of other namespaces. For example, You need to have different names for deployments/services in a namespace but you can ha
9 min read
Kubernetes - NodeKubernetes Nodes are the Worker or master machines where the actual work happens. Each Kubernetes node has the services required to execute Pods and is controlled by the Control Plane. Each Kubernetes Node can have multiple pods and pods have containers running inside them. 3 processes in every Node
13 min read
Kubernetes - NodePort ServiceNodePort service in Kubernetes is a service that is used to expose the application to the internet from where the end-users can access it. If you create a NodePort Service Kubernetes will assign the port within the range of (30000-32767). The application can be accessed by end-users using the node's
5 min read
Kubernetes - ClusterIP vs NodePort vs LoadBalancerThree main service types are used in Kubernetes networking: ClusterIP, NodePort, and LoadBalancer. Each has a specific function in controlling external access and service-to-service communication. Comprehending their distinctions is essential for efficiently coordinating applications. This article e
7 min read
Kubernetes - ServicesSoftware deployment, scaling, and management are all automated using Kubernetes, an open-source container orchestration system. K8s is another name for Kubernetes. Kubernetes was initially developed by Google and is now managed by the Cloud Native Computing Foundation. Despite the fact that it now s
3 min read
Kubernetes Pods: How to Create and Manage ThemKubernetes is an open-source container orchestration system mainly used for automated software deployment, management, and scaling. Kubernetes is also known as K8s. Kubernetes was originally developed by Google, but it is now being maintained by the Cloud Native Computing Foundation. It was original
13 min read
How to Run Shell Commands in Kubernetes Pods or ContainersIn Kubernetes, we create pods by adding an extra layer of information on containers. This Kubernetes in short is known as K8s, an open-source container orchestration tool developed by Google. It is used to orchestrate the containers for bringing Agility in software deployment through scaling, and ma
6 min read
Kubernetes - Creating Multiple Container in a PodPre-requisite:- Kubernetes Kubernetes is a container management tool and it automates container deployment, load balancing, and container scaling. It is open-source and developed by Google in 2014 and written in Golang. All cloud providers adopt Kubernetes. It is scheduled runs and manages isolated
3 min read
Kubernetes - Replication ControllerWith the help of the open-source container orchestration technology Kubernetes, software deployment, scalability, and management are mostly automated. Another name for Kubernetes is K8s. Google created Kubernetes, which is now overseen by the Cloud Native Computing Foundation. Even though it now wor
7 min read
Kuberneters - Difference Between Replicaset and Replication ControllerPre-requisite: Kubernetes Kubernetes is also known as K8s is an open-source container orchestration tool developed by google which is used for automating software deployment, scaling, and management. Currently, it is being maintained by the cloud native computing foundation(CNCF). K8s has two versio
4 min read
What is Kubernetes Deployment?Kubernetes is an open-source Container Management tool that automates container deployment, container scaling, descaling, and container load balancing (also called as container orchestration tool). It is written in Golang and has a huge community because it was first developed by Google and later do
10 min read
Configmaps
Kubernetes - ConfigMapsKubernetes allows you to run and manage applications in containers. However, when you need to update configurations like usernames, passwords, or URLs without modifying the application code, ConfigMaps provide an efficient solution. ConfigMaps separate application configuration from the application
10 min read
Kubernetes - Create Config Map From FilesPre-requisite: Kubernetes While creating a manifest file in Kubernetes, we can define environment variables. However, when you have a lot of manifest files, it will become difficult to manage the environment data stored in various manifest files. To overcome this issue, we can manage environment dat
3 min read
Kubernetes - Create ConfigMap From YAML FileA ConfigMap is a dictionary consisting of non-confidential data. Its primary role is to keep the configuration separate from the container image. ConfigMap can be created in different ways. This article will cover the declarative approach to creating ConfigMap from the YAML file. Example: apiVersion
1 min read
Kubernetes - Config Map From DirectoryPre-requisite:- Kubernetes Software deployment, scalability, and administration are mostly automated using Kubernetes, an open-source container orchestration framework. K8s is another name for Kubernetes. Kubernetes was initially developed by Google and is now managed by the Cloud Native Computing F
2 min read
Kubernetes - Injecting ConfigMap as FilesPre-requisite:- Kubernetes The automated deployment, scaling, and administration of software using a system called Kubernetes, an open-source container orchestration tool. K8s is another name for Kubernetes. Kubernetes was initially developed by Google and is now managed by the Cloud Native Computin
3 min read
Kubernetes - Injecting ConfigMap in PodsPre-requisite: Kubernetes Leveraging the open-source container orchestration engine Kubernetes to automate the deployment, scalability, and management of applications. Another name for Kubernetes is K8s. Google originally created Kubernetes, which is currently overseen by the Cloud Native Computing
3 min read
Scaling and Updating Applications
Kubernetes - Service DNS An open-source container orchestration system called Kubernetes is primarily employed for the automated deployment, scaling, and management of software. Another name for Kubernetes is K8s. Initially created by Google, Kubernetes is currently maintained by the Cloud Native Computing Foundation. Altho
11 min read
Additional Topics
What is Kubernetes API ?Complete GuideKubernetes API is an application that serves Kubernetes functionality through a RESTful interface and stores the state of the cluster via HTTP. Users can directly interact with the Kubernetes API or via tools like kubectl. It supports retrieving, creating, updating, and deleting primary resources vi
14 min read
Kubernetes - Taint and TolerationA pod is a group of one or more containers and is the smallest deployable unit in Kubernetes. A node is a representation of a single machine in a cluster (we can simply view these machines as a set of CPU and RAM). A node can be a virtual machine, a physical machine in a data center hosted on a clou
6 min read
Kubernetes Resource Model (KRM) and How to Make Use of YAML?Here we will explain how YAML can simplify system management and automation of most processes so that Kubernetes is a convenient working system. Basic Kubernetes Models: KRM and Everything-as-CodeAccording to Kubernetes co-founder Brian Grant, Kubernetes is very convenient thanks to the Kubernetes R
6 min read
Installing Private Git Server on K8s Cluster with Gitea and AKSIn this article, we are going to install a self-hosted Gitea server on top of Azure Kubernetes Service with Helm and set up a git repo. Having a private Git server might be beneficial these days. Gitea is a community-managed Git-compatible lightweight code hosting solution written in Go. It is publi
4 min read
Enable Remote Debugging For Java Application Deployed in Kubernetes EnvironmentDuring Development, developers have to debug their applications to resolve code problems. In order to debug a java application which is deployed on remote machine in a Kubernetes cluster, first developer has to do some steps to enable its application ready for debugging. Below are the manual steps t
2 min read
How to Enable JMX For Java Application Running in the Kubernetes Cluster?Many times we want to monitor our application's CPU utilization, background thread behavior, and most importantly memory consumptions for tasks that deal with loads for data (500MB - 1GB) or much more data. Such monitoring helps to find which operation is causing heavy CPU or Memory utilization and
3 min read