How do I create a Kubernetes Secret?
Reviewed by Prabath Thalangama · Last updated
A Secret's data field holds base64-encoded values, so each value must be encoded before it goes into the manifest. This tool turns KEY=value lines into an Opaque Secret manifest with every value encoded, and decodes an existing Secret's data and stringData back to plain text, entirely in your browser.
Base64 is an encoding, not encryption. Anyone who can read the Secret object, or the YAML file, can decode it in one command. Protect Secrets with RBAC, enable encryption at rest for etcd, and keep plain Secret manifests out of Git; use Sealed Secrets, SOPS or an external secret manager instead.
Values are encoded as UTF-8 exactly as typed. A trailing newline or space becomes part of the secret, which is a common reason a password from a Secret doesn't work.
How do I encode or decode a Secret?
- To encode, enter one KEY=value pair per line, plus the Secret name and namespace.
- Copy the generated manifest and apply it with kubectl apply -f.
- To decode, paste a Secret manifest (for example the output of kubectl get secret -o yaml) and read the KEY=value lines.
How to read the results
- Encoded manifest
- apiVersion v1, kind Secret, type Opaque, with each value base64-encoded under data. Name defaults to my-secret and namespace to default.
- Decoded values
- One KEY=value line per entry from data (decoded) and stringData (shown as is). A value that isn't valid base64 is marked instead of being guessed.
Common Secret errors
illegal base64 data at input byte
A value under data isn't base64-encoded, or was encoded with line breaks. Encode it here, or move plain-text values to stringData, which the API server encodes for you.
Password from the Secret is rejected
The value was encoded with a trailing newline, as echo does. Use echo -n or printf, and decode the Secret here to check for invisible characters.
echo -n 's3cret' | base64Examples and command-line equivalents
Create the same Secret with kubectl
kubectl create secret generic db-credentials \
--from-literal=username=app --from-literal=password='s3cret' \
--dry-run=client -o yamlRead one value from a Secret
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -dFrequently asked questions
data or stringData?
stringData accepts plain text and the API server encodes it for you, which is easier to write by hand. data requires values that are already base64-encoded. If a key appears in both, stringData wins.
Are Kubernetes Secrets encrypted?
Not by default. They are stored base64-encoded in etcd. Encryption at rest has to be enabled with an EncryptionConfiguration, and managed clusters usually offer it as a setting or with a cloud KMS key.
Is it safe to paste a Secret into this tool?
Encoding and decoding happen in your browser and nothing is sent to our servers. Treat production secrets with care anyway, and rotate any secret that has been exposed.