GlossarySecret

Secret

A Kubernetes Secret is a resource that stores sensitive data, such as passwords, API tokens, and keys, so pods can use it without placing it in images or code.

Table of Contents

Table of Contents

Further Reading

No items found.
No items found.
No items found.
No items found.
No items found.
No items found.

How Kubernetes Secrets work

Secrets keep credentials out of container images and source code. Pods receive them at runtime.

  1. Create a Secret from literal values, files, or a manifest.
  2. Reference the Secret in a pod or Job spec.
  3. Kubernetes exposes it as environment variables or mounted files.
  4. The application or test reads the values at runtime.
  5. Rotate the Secret, and new pods pick up the new values.

Secrets vs. ConfigMaps

Both inject configuration into pods. Only Secrets are meant for sensitive data.

Secret ConfigMap
Purpose Sensitive data Non-sensitive settings
Examples API tokens, passwords, TLS keys URLs, feature flags, log levels
Default storage Base64-encoded Plain text
Access control Should be tightly restricted Usually broader

Why Secrets matter in Kubernetes

Secrets are central to Kubernetes security and configuration. Without them, clusters risk credential leaks and compliance problems.

  • Protection: credentials stay out of version control
  • Environment flexibility: different credentials for test, staging, and production
  • Central management: one place for credentials across workloads
  • Secure automation: CI/CD tools and cloud services get credentials safely
  • Compliance: supports data protection requirements

Consider a SaaS team that found an API key committed in a test file. Moving it into a Secret and rotating it closed the gap without changing the test logic.

Common challenges with Secrets

  • Weak storage: Secrets left unencrypted at rest or in plain files
  • Broad access: too many users or service accounts can read them
  • Versioning: changes to sensitive config are hard to track
  • Rotation: expired or stale Secrets cause failures and risk
  • Namespace leaks: Secrets shared across environments by mistake
  • Integration: aligning Secrets across Kubernetes, CI/CD, and test tools

Best practices

  • Encrypt at rest: enable encryption for Secrets in etcd
  • Least privilege: restrict who and what can read each Secret
  • External managers: use Vault or a cloud secrets manager for rotation
  • Rotate regularly: replace credentials on a schedule
  • Scope by namespace: keep Secrets inside the environment that needs them

How Secrets relate to Testkube

Testkube uses Kubernetes Secrets to handle sensitive data during test execution. Credentials reach tests safely without living in test code.

  • Native Secrets: credentials and tokens stored as Kubernetes Secrets
  • Pod injection: values exposed as environment variables or mounted files
  • Less exposure: sensitive values kept out of test code, logs, and reports
  • External stores: works with HashiCorp Vault or AWS Secrets Manager
  • Parameterized tests: Secret-backed inputs for dynamic workflows
  • CI/CD: pipelines pass credentials securely to tests

Real-world examples

  • Authenticated APIs: a QA engineer stores API keys as Secrets for endpoint tests
  • Database access: a DevOps team connects Testkube tests to internal databases with Secrets
  • Rotation: a platform engineer automates Secret rotation across namespaces
  • Integration tests: a developer mounts Secrets into Testkube pods for third-party APIs
  • Audits: a security team reviews how tests use Secrets

Frequently Asked Questions (FAQs)

What is a Kubernetes Secret?

A Secret is a resource that stores sensitive data, such as passwords and tokens, for pods to use.

Are Kubernetes Secrets encrypted?

By default they are only base64-encoded. Enable encryption at rest and restrict access for real protection.

What is the difference between a Secret and a ConfigMap?

Secrets hold sensitive data. ConfigMaps hold non-sensitive configuration.

How do pods use Secrets?

Pods read Secrets as environment variables or as files mounted into the container.

How does Testkube handle Secrets?

Testkube injects Kubernetes Secrets into test pods and supports external secret managers.

Should I use an external secrets manager?

Often, yes. Tools like Vault add rotation, auditing, and central control.

Related Terms and Concepts

No items found.