World map

 

BM

World K4: Notes, Lockers & Packages

Secrets: base64 is not a lock

You will learn: to hand a password to a pod with a Secret, and what really keeps it safe.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

You are here: cluster kind-dev namespace default

You put the till password in a Secret: The locked spice box for passwords and tokens. Its base64 hides nothing, so limit who can read it.. Its YAML says c3VwM3ItcmFoc2lh. It looks scrambled. But is it safe?

Watch

bash
echo c3VwM3ItcmFoc2lh | base64 -d
sup3r-rahsia

One command turns it back. That was base64: any bytes written as plain letters. It is a sticker that looks like a lock.

Predict

Who can read the till password right now?

Try it

Make the Secret and open the till. Then check its password.

You are here: cluster kind-dev namespace default
dev-control-planeOpenManager

No trays here.

dev-workerOpen

No trays here.

dev-worker2Open

No trays here.

Time: +0s (sped up)

Try it

A teammate wrote this Secret by hand. Apply fails. Fix it.

Fix the manifest, then press Apply.

secret.yaml8 lines

Watch

Drag a card into a box. Or tap the card, then tap the box.

      Real locks exist. With encryption at rest, the API server locks Secrets before saving them. RBAC decides who may read them.

      Check

      Good habit or not? Swipe each one.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Commit secret.yaml with the real password to Git.

      You did it!

      You can now hand a pod a password with a Secret, safely.

      Go deeper (optional)

      kubectl describe secret till shows sizes, never values. Mount a Secret as files, not env vars. Env vars can leak into crash reports. Managed clusters often encrypt Secrets with a cloud key (KMS). Next lesson: keeping Secrets out of Git.

      Real rep (optional), on a practice cluster only. Use a fake password:

      Real mission

      1. kubectl config current-context
      2. kubectl create secret generic till --from-literal=PASSWORD=practice-only
      3. kubectl get secret till -o jsonpath={.data.PASSWORD}
      4. echo cHJhY3RpY2Utb25seQ== | base64 -d
      5. kubectl delete secret till

      0 of 5 steps done · Your ticks are saved.