🔐 Secrets

A Secret stores sensitive information, such as database passwords, tokens and API keys, separate from the application code and from regular settings (ConfigMap).

warning

By default, a Secret is only base64-encoded, not encrypted. Anyone with permission to read Secrets in the cluster can see the value. That is why you should control who has access using RBAC.

info

Secrets are created with kubectl. The Nuvion Panel does not have a screen for this feature.

---

🚀 Before you start

• Have cluster access configured (see Cluster Access).
• Use test values in this guide. Do not use real passwords.

🚀 1. Create a Secret

kubectl create secret generic db-secret --from-literal=DB_USER=app --from-literal=DB_PASSWORD='troque-esta-senha'

Expected output: secret/db-secret created

🚀 2. Verify the Secret

kubectl get secret db-secret
kubectl describe secret db-secret

describe shows only the size of each value, not the content.

🚀 3. See the stored value

🐧 Linux / macOS

kubectl get secret db-secret -o jsonpath='{.data.DB_PASSWORD}' | base64 -d

🪟 Windows (PowerShell)

$v = kubectl get secret db-secret -o jsonpath="{.data.DB_PASSWORD}"
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($v))

This shows why it is important to restrict access to Secrets.

🚀 4. Use the Secret in a pod

Create the file pod-secret.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-secret
spec:
  containers:
    - name: app
      image: busybox
      command: ["sh", "-c", "echo Usuario: $DB_USER; sleep 3600"]
      env:
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_USER
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_PASSWORD

kubectl apply -f pod-secret.yaml
kubectl logs pod-secret

Expected output: Usuario: app

To confirm the password reached the pod without displaying it:

kubectl exec pod-secret -- sh -c 'test -n "$DB_PASSWORD" && echo "Senha definida"'

🔒 Best practices

• Never print passwords in application logs.
• Do not save YAML files with passwords in repositories (Git).
• Give Secret read access only to those who need it.
• Rotate passwords periodically.

✅ How to know it worked

The pod becomes Running, the log shows Usuario: app and the last command shows Senha definida.

❗ Common problems

Symptom	Cause	Solution
Pod with CreateContainerConfigError	Secret or key does not exist	Check the Secret name and the key (key)
secrets "db-secret" not found	Secret in another namespace	Create it in the same namespace as the pod
Password with special characters breaks the command	Missing quotes	Wrap the value in single quotes

🧹 Cleanup

kubectl delete pod pod-secret
kubectl delete secret db-secret

🧠 Questions?

Talk to our SaveinCloud technical support team!