Menu
Why does k8s secrets need to be base64 encoded when configmaps does not?
When creating a configmap you simply do somthing like this:
apiVersion: v1 kind: ConfigMap metadata: name: my-configmap data: SOME_KEY: a string value But when you want to create a secret you have to echo -n "some secret string" | base64 and then put the result of that in a file looking something like this:
apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: SOME_KEY: c29tZSBzZWNyZXQgc3RyaW5n I really wonder why there is this difference? Are kubernetes secrets simply base64 encoded strings? I would expect that secrets were stored encrypted in kubernetes.
816
The data and the stringData fields are optional. The values for all keys in the data field have to be base64-encoded strings.
Base64 encoding schemes are commonly used when there is a need to encode binary data that needs to be stored and transferred over media that are designed to deal with ASCII. This is to ensure that the data remain intact without modification during transport.
Secrets in Kubernetes Both ConfigMaps and secrets store the data the same way, with key/value pairs, but ConfigMaps are meant for plain text data, and secrets are meant for data that you don't want anything or anyone to know about except the application.
Kubernetes encodes the Secret data in base64 format. When you need to reveal a Secret text, you must base64-decode it. To enable containers to access Secrets, you have the option to mount the Secret as a volume.
Secrets can contain binary data (the type is map[string][]byte), and byte arrays are base64-encoded in JSON serialization.
ConfigMaps only contain string data (the type is map[string]string), so the JSON serialization just outputs the string.
In 1.10, ConfigMaps have a new binaryData field that allows storing binary data, which is base64-encoded, just like secrets. https://github.com/kubernetes/kubernetes/pull/57938
81
Why does k8s secrets need to be base64 encoded
This allows you to provide binary data (certificates etc.) as secret, and also escape any tricky characters such as " ' \ etc.
Are kubernetes secrets simply base64 encoded strings?
Yes, kubernetes secrets are not encrypted by default. You have to set up encryption at rest on your own, see https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
41
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
