Secrets

kubectl create secret generic postgres-credentials \
  --from-literal=POSTGRES_USER=payment_user \
  --from-literal=POSTGRES_PASSWORD=s3cur3P@ssw0rd \
  --from-literal=POSTGRES_DB=payments \
  -n payments
# generic = Opaque type — the default for arbitrary key-value secrets
# --from-literal: values are provided inline on the command line
# The values are base64-encoded automatically by kubectl before storing in etcd
# This command is safe because the value never touches a file — but it does appear in shell history

kubectl create secret generic postgres-credentials \
  --from-env-file=.env \
  -n payments
# --from-env-file: reads a KEY=value file (like a .env file) and creates one secret entry per line
# Better than --from-literal for multiple values — .env file is gitignored, not committed

kubectl create secret generic payment-gateway-key \
  --from-literal=API_KEY=pk_live_51NxKjQ2eZvKYlo \
  -n payments

kubectl create secret docker-registry registry-credentials \
  --docker-server=registry.company.com \
  --docker-username=ci-bot \
  --docker-password=ghp_xxxxxxxxxxxx \
  --docker-email=ci@company.com \
  -n payments
# docker-registry: creates a kubernetes.io/dockerconfigjson type secret
# Used in imagePullSecrets to authenticate with private container registries

echo -n "payment_user" | base64
# -n: suppress the trailing newline — CRITICAL — without -n, the newline gets encoded too
# This produces: cGF5bWVudF91c2Vy
# The trailing newline bug is one of the most common Secret encoding mistakes

echo -n "s3cur3P@ssw0rd" | base64
# Produces: czNjdXIzUEBzc3cwcmQ=

echo -n "payments" | base64
# Produces: cGF5bWVudHM=

apiVersion: v1
kind: Secret
metadata:
  name: postgres-credentials     # Secret name — referenced by Pods that consume it
  namespace: payments
  labels:
    app: payment-processor
type: Opaque                      # Opaque = arbitrary key-value secret, no schema enforced
data:                             # data: values MUST be base64-encoded
  POSTGRES_USER: cGF5bWVudF91c2Vy          # base64("payment_user")
  POSTGRES_PASSWORD: czNjdXIzUEBzc3cwcmQ=  # base64("s3cur3P@ssw0rd")
  POSTGRES_DB: cGF5bWVudHM=                # base64("payments")

---

apiVersion: v1
kind: Secret
metadata:
  name: payment-gateway-credentials
  namespace: payments
type: Opaque
stringData:                       # stringData: accepts PLAINTEXT — Kubernetes encodes it at apply time
  API_KEY: "pk_live_51NxKjQ2eZvKYlo"       # Write the raw value here — no base64 needed
  API_SECRET: "sk_live_AbCdEfGhIjKlMn"     # Kubernetes converts to base64 before storing in etcd
                                            # stringData is WRITE-ONLY — it won't appear in kubectl get output
                                            # The encoded value appears in data after apply

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-processor
  namespace: payments
spec:
  replicas: 2
  selector:
    matchLabels:
      app: payment-processor
  template:
    metadata:
      labels:
        app: payment-processor
    spec:
      imagePullSecrets:                  # imagePullSecrets: authenticate to private container registry
        - name: registry-credentials     # Reference the docker-registry Secret we created earlier
                                         # Without this, pods fail with ErrImagePull on private images

      containers:
        - name: payment-processor
          image: registry.company.com/payment-processor:3.1.0
          ports:
            - containerPort: 8080
          env:
            - name: POSTGRES_USER        # Env var name in the container
              valueFrom:
                secretKeyRef:            # secretKeyRef: pull a single key from a Secret
                  name: postgres-credentials  # Which Secret to read from
                  key: POSTGRES_USER     # Which key within the Secret
                  optional: false        # optional: false means Pod fails if Secret doesn't exist
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: POSTGRES_PASSWORD
                  optional: false
            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: POSTGRES_DB
          envFrom:
            - secretRef:                 # secretRef: inject ALL keys from a Secret as env vars
                name: payment-gateway-credentials  # All keys become env vars: API_KEY, API_SECRET
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "300m"
              memory: "256Mi"

kubectl create secret tls postgres-tls \
  --cert=client.crt \
  --key=client.key \
  -n payments
# tls subcommand: creates a kubernetes.io/tls type Secret
# --cert: path to the PEM-encoded certificate file
# --key: path to the PEM-encoded private key file
# Kubernetes stores them under the keys tls.crt and tls.key

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-processor
  namespace: payments
spec:
  replicas: 2
  selector:
    matchLabels:
      app: payment-processor
  template:
    metadata:
      labels:
        app: payment-processor
    spec:
      containers:
        - name: payment-processor
          image: registry.company.com/payment-processor:3.1.0
          volumeMounts:
            - name: tls-certs             # Must match volumes[].name below
              mountPath: /etc/ssl/certs   # Path where the cert files will appear in the container
              readOnly: true              # readOnly: always use true for secrets mounted as files
      volumes:
        - name: tls-certs
          secret:                         # secret: mount a Secret as a volume (vs configMap:)
            secretName: postgres-tls      # Which Secret to expose as this volume
            defaultMode: 0400             # defaultMode: file permissions in octal
                                          # 0400 = owner read-only — prevents accidental writes
                                          # Private keys should always be 0400 or 0600