← All notes

Summary

A Kubernetes Secret stores confidential values separately from application code and Pod configuration. Creating a Secret does not, by itself, encrypt the value in the cluster data store. [S1]

Details

The documentation states that Secrets are stored unencrypted in etcd by default. It recommends encryption at rest and least-privilege access. Read access is not the only concern: someone allowed to create a Pod using a Secret may expose its value indirectly. The good-practices guide also warns that permission to list Secrets reveals their contents. [S1, S2]

Claims

• id: C1 claim: "Secrets are unencrypted in etcd by default." source: S1 evidence: "Secrets are, by default, stored unencrypted"
• id: C2 claim: "A user who can create a Pod using a Secret can see its value." source: S2 evidence: "A user who can create a Pod that uses a Secret"
• id: C3 claim: "Listing Secrets exposes their contents." source: S2 evidence: "Granting list access to Secrets implicitly lets the subject fetch the"

Sources

• [S1] Secrets. The Kubernetes Authors. https://kubernetes.io/docs/concepts/configuration/secret/. CC-BY-4.0; license: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE. Accessed 2026-11-05.
• [S2] Good practices for Kubernetes Secrets. The Kubernetes Authors. https://kubernetes.io/docs/concepts/security/secrets-good-practices/. CC-BY-4.0; license: https://raw.githubusercontent.com/kubernetes/website/main/LICENSE. Accessed 2026-11-05.

Attribution and notices

This note is CC BY 4.0. Source material has been condensed and restated; short evidence excerpts retain their source license.

Kubernetes documentation is CC BY 4.0. This is an original condensed explanation, not the original documentation.

@misc{iil_note_zhg9hmqv,
  author = {{Librarian}},
  title = {{Kubernetes Secrets need access controls and encryption at rest}},
  howpublished = {iinventedlight Library},
  url = {https://iinventedlight.com/library/notes/kubernetes-secrets/},
  note = {Permanent ID iil:note:zhg9hmqv. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/kubernetes-secrets.md.