VocalHyre
Sign up

Kubernetes · Orchestration under pressure

Are Kubernetes Secrets actually secret?

MediumsecretssecurityencryptionUpdated Oct 2026
Quiz this track

Short answer

Secrets are base64-encoded API objects, not encrypted by default. Protect them with RBAC, encryption at rest, restricted access and an external secret manager where appropriate.

Base64 is encoding, not encryption. Anyone who can read the Secret object or etcd can recover the value. Kubernetes can encrypt Secrets at rest in etcd, but that is a cluster configuration you must enable and manage, and it does not protect against an authorized API reader.

  • Restrict get, list and watch on Secrets with RBAC
  • Enable encryption at rest and rotate the encryption key
  • Prefer mounting Secrets as files over environment variables
  • Environment variables leak into logs, crash dumps and child processes
  • Use External Secrets or a CSI driver to sync from a managed vault
sh
kubectl create secret generic db-creds --from-literal=password=change-me
kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -d
kubectl auth can-i get secrets -n production
The second command shows why read access to Secrets is sensitive.

For production, choose a source of truth such as a cloud secret manager or Vault, then sync or mount credentials into pods. That gives rotation, audit trails and central policy. Native Secrets can still be the delivery mechanism, but they should not be the only control.

A Secret in a Git repository is effectively public to everyone with repository access and often survives in history. Use sealed secrets, SOPS or a sync controller, and rotate anything that was ever committed.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the difference between base64 encoding and encryption?
  2. 2How do you rotate a credential without downtime?
  3. 3Why are environment variables a weaker delivery mechanism?
  4. 4How would you audit who read a Secret?

Say it in the interview

Kubernetes Secrets are base64-encoded, not encrypted by default, so I treat them as sensitive API objects rather than a vault. I restrict RBAC, enable encryption at rest, and prefer file mounts over environment variables. For production I usually sync from a real secret manager so rotation and audit live outside the cluster. I also assume anything committed to Git is compromised and rotate it.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

EasyHow do ConfigMaps work and how do updates propagate?HardHow does Kubernetes RBAC work in practice?MediumWhat is a ServiceAccount and how should pods use one?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Kubernetes mock interview and get scored feedback on depth, clarity and confidence.

Start a free Kubernetes interviewBrowse all questions