Decode only the key you need with kubectl get secret ... -o jsonpath, then project that key through a Secret volume with an explicit items list and readOnly: true. Kubernetes Secrets use Base64 for representation, not encryption.
Decode one Secret value safely
Retrieve a single key and decode it in one pipeline:
As an Amazon Associate I earn from qualifying purchases.
kubectl get secret db-user-pass -o jsonpath='{.data.password}' | base64 --decodeThis avoids asking kubectl to print the whole object. The Kubernetes kubectl guidance also warns that placing the encoded value in a separate shell command can leave it in shell history. Ordinary kubectl get and kubectl describe output does not print Secret contents by default.
Decode a different key
Replace password with the exact key stored under .data. JSONPath emits no trailing newline from the Secret; the decoder’s output is the value itself. On systems whose Base64 utility uses a different flag, use that platform’s decode option rather than changing the Secret.
#1 Best Overall
Base64 is not encryption
A Secret manifest can put encoded strings under data, or ordinary strings under stringData; the API server encodes stringData for storage in the Secret object.
apiVersion: v1
kind: Secret
metadata:
name: db-user-pass
type: Opaque
stringData:
password: 'S!B*d$zDsb='If you use data instead, encode the value without accidentally adding a newline:
echo -n 'S!B*d$zDsb=' | base64A newline included before encoding becomes part of the decoded credential. Base64 provides no confidentiality: anyone who can read the Secret object or a manifest containing its data can decode it. Treat manifests, backups and command output accordingly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Mount only one key in one container
The following Pod projects only the password key. The resulting file is /etc/secret/password.
apiVersion: v1
kind: Pod
metadata:
name: secret-reader
spec:
containers:
- name: app
image: nginx
volumeMounts:
- name: secret-volume
mountPath: /etc/secret
readOnly: true
volumes:
- name: secret-volume
secret:
secretName: db-user-pass
items:
- key: password
path: passwordWhat the projection does
secretNameselects the Secret object.itemsis an allow-list: omitted keys are not projected.- Every key listed in
itemsmust exist, or the volume cannot be populated as requested. pathcontrols the filename beneathmountPath.readOnly: trueprevents the container from requesting a writable mount.
Kubernetes Secret volumes are intrinsically read-only and backed by tmpfs, so their contents are not written to nonvolatile node storage. The explicit mount flag documents and enforces the intended container contract.
Tighten file permissions
Set a restrictive mode when the application does not need group or world read access:
Rank #4
volumes:
- name: secret-volume
secret:
secretName: db-user-pass
defaultMode: 0400
items:
- key: password
path: passwordUse a per-key mode when different projected files require different permissions.
Updates, subPath and rotation
Normal Secret-volume projections can reflect later Secret updates according to kubelet propagation timing. A Secret consumed through a subPath mount does not receive subsequent updates. Avoid subPath when an application must observe rotated values, and design the application to reopen or reload the file as appropriate.
Best Value
Keep the exposure boundary narrow
- Mount the volume only in the container that needs the credential; do not add the volume mount to sidecars by default.
- Use least-privilege RBAC so only the required service account or operators can read this Secret.
- Enable encryption at rest for Secrets in the cluster’s backing datastore.
- Do not commit Base64 data or
stringDatacredentials to source control, tickets or shared manifests. - Prevent applications from logging, debugging or transmitting Secret contents after reading them.
- Keep an individual Secret below Kubernetes’ 1 MiB maximum; the limit also helps avoid API-server and kubelet memory pressure.
Choose a delivery method
| Method | Container scope | Exposure form | Rotation behavior | Protection and operations |
|---|---|---|---|---|
Secret volume with items |
Only containers with the volume mount | File in the container filesystem namespace | Projected files can update; subPath mounts do not |
Read-only tmpfs; RBAC and encryption-at-rest still required |
| Environment variable from a Secret | Each container declaring the reference | Process environment, potentially visible to diagnostics and child processes | Existing processes generally need a restart to receive a changed value | Simple configuration, but broader process-level exposure |
| External Secret store provider | Depends on the provider integration | Provider-defined file or process interface | Provider-dependent rotation and synchronization | Can add stronger key-management boundaries, with additional components and operational complexity |
For a single file credential, the allow-listed Secret volume is usually the narrowest Kubernetes-native interface. Consider an external Secret store when centralized key management, independent rotation or stronger separation from the Kubernetes API is a requirement.
Quick Recap
Common failure checks
- Empty decode: verify the Secret name, namespace context and exact key spelling; inspect metadata without printing values.
- Volume not populated: confirm every key named in
itemsexists and that the Pod references the correct Secret name. - Permission denied: check the container user,
defaultModeand any security policy that changes filesystem access. - Rotated value not visible: check whether the application uses a
subPathmount or needs to reload the file after an update. - Unexpected bytes: recreate the encoded value with
echo -nor another method that does not append a newline.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
