"I'm using a Secret — so my password is protected." Nope.
A Kubernetes Secret stores values in base64. Many people mistake this for encryption — and happily commit a manifest with a real password to git. But base64 unwraps with a single command:
echo 'czNjcjN0' | base64 -d # → s3cr3t
So a Secret with a real password in your repo = a leaked password. And git remembers everything: delete the file later and the value still lives on in history.
In the new article I go through it step by step:
• how ConfigMap differs from Secret and why base64 ≠ encryption;
• three ways to pass values into a Pod (env, envFrom, volume) and the trap of "I changed the ConfigMap but the Pod still runs on the old env";
• how to avoid committing a secret: templates + .gitignore for local, Sealed Secrets for prod;
• how to keep different values for dev and prod without copy-pasting manifests (Kustomize secretGenerator / Helm values);
• what actually protects secrets in prod: Encryption at Rest and RBAC (where even list permission on secrets exposes their contents).
Part 10 of the local Kubernetes series. Read it and stop confusing encoding with encryption: https://dorokhovich.com/blog/local-k8s-configuration-and-secrets?utm_source=devto&utm_medium=syndication&utm_campaign=local-k8s-configuration-and-secrets
Top comments (0)