---
title: Kubernetes Secrets need access controls and encryption at rest
slug: kubernetes-secrets
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source: https://iinventedlight.com/library/notes/kubernetes-secrets.md
source_license: CC-BY-4.0
attribution: Original synthesis by iinventedlight, drafted by Librarian with AI assistance; based on the attributed sources
  below.
author: Librarian
client: Librarian
date: '2026-11-05'
checked_on: '2026-11-05'
as_of: '2026-11-05'
status: published
confidence: medium
category: coding-references
tags:
- kubernetes
- secrets
untested: Reference note. No code or commands were run to validate behavior.
sources:
- id: S1
  title: Secrets
  publisher: The Kubernetes Authors
  url: https://kubernetes.io/docs/concepts/configuration/secret/
  accessed: '2026-11-05'
  license: CC-BY-4.0
  license_url: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE
  license_verified: '2026-11-05'
  green: true
  attribution: The Kubernetes Authors; Secrets; CC-BY-4.0
  snapshot: _fetched/k-secrets.txt
- id: S2
  title: Good practices for Kubernetes Secrets
  publisher: The Kubernetes Authors
  url: https://kubernetes.io/docs/concepts/security/secrets-good-practices/
  accessed: '2026-11-05'
  license: CC-BY-4.0
  license_url: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE
  license_verified: '2026-11-05'
  green: true
  attribution: The Kubernetes Authors; Good practices for Kubernetes Secrets; CC-BY-4.0
  snapshot: _fetched/k-secretgood.txt
---
# Kubernetes Secrets need access controls and encryption at rest

## Summary
A Kubernetes Secret stores confidential values separately from application code and Pod configuration. Creating a Secret does not, by itself, encrypt the value in the cluster data store. [S1]

## Details
The documentation states that Secrets are stored unencrypted in etcd by default. It recommends encryption at rest and least-privilege access. Read access is not the only concern: someone allowed to create a Pod using a Secret may expose its value indirectly. The good-practices guide also warns that permission to list Secrets reveals their contents. [S1, S2]

## Claims
- id: C1
  claim: "Secrets are unencrypted in etcd by default."
  source: S1
  evidence: "Secrets are, by default, stored unencrypted"
- id: C2
  claim: "A user who can create a Pod using a Secret can see its value."
  source: S2
  evidence: "A user who can create a Pod that uses a Secret"
- id: C3
  claim: "Listing Secrets exposes their contents."
  source: S2
  evidence: "Granting list access to Secrets implicitly lets the subject fetch the"

## Sources
- [S1] Secrets. The Kubernetes Authors. https://kubernetes.io/docs/concepts/configuration/secret/. CC-BY-4.0; license: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE. Accessed 2026-11-05.
- [S2] Good practices for Kubernetes Secrets. The Kubernetes Authors. https://kubernetes.io/docs/concepts/security/secrets-good-practices/. CC-BY-4.0; license: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE. Accessed 2026-11-05.

## Attribution and notices
This note is CC BY 4.0. Source material has been condensed and restated; short evidence excerpts retain their source license.

Kubernetes documentation is CC BY 4.0. This is an original condensed explanation, not the original documentation.