Free tools Windows power users keep installed
One-click scans. No signup required.
Decode an individual Secret value with kubectl when you need to inspect it; mount the Secret as a volume when an application needs to read its values as files. Secret data is base64-encoded, not encrypted by that encoding, and Secret volumes are read-only. These steps limit how an application receives a value, but they do not replace access controls or encryption at rest.
Decode one Secret value with kubectl
Secret values in the API’s data field are base64-encoded. To print one value, substitute the Secret name and key in this command:
As an Amazon Associate I earn from qualifying purchases.
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 --decodeThe decoded value is written to standard output. Base64 is a reversible encoding, not encryption; Kubernetes cautions against treating it as confidentiality. Avoid displaying the output where unauthorized people can see it, and do not put secret values in shell history or command logs. See Kubernetes’ Secrets documentation and kubectl Secret guidance.
Mount a Secret as read-only files
A Secret volume exposes each Secret key as a file, with the value decoded for the application to read. The Secret and Pod must be in the same namespace. Add a volume to the Pod and mount it only in the container that needs the data:
#1 Best Overall
apiVersion: v1
kind: Pod
metadata:
name: app
spec:
containers:
- name: app
image: example/app:stable
volumeMounts:
- name: app-secret
mountPath: /etc/app-secret
readOnly: true
volumes:
- name: app-secret
secret:
secretName: my-secretWith the default key mapping, a Secret key named password is available to the container at /etc/app-secret/password. Secret volumes are inherently read-only; specifying readOnly: true makes the intended mount mode explicit. The example shows manifest structure and is not a tested deployment. Refer to Kubernetes’ Volumes documentation and Secrets documentation.
Expose only selected keys or change their file paths
By default, all keys are projected using their key names as filenames. Use items as an allowlist when the application needs only some keys, or when a key should appear at a different relative path:
volumes:
- name: app-secret
secret:
secretName: my-secret
items:
- key: password
path: credentials/passwordMounted at /etc/app-secret, this mapping makes the value available at /etc/app-secret/credentials/password. If items is specified, only the listed keys are projected, and every listed key must exist for the volume to be created. Restricting the projection to the keys the application needs reduces its exposure. Details are in Distribute Credentials Securely Using Secrets.
Set file permissions where needed
Secret volume files default to mode 0644. Set defaultMode on the Secret volume for a volume-wide mode, or specify mode for an individual key to override it. For example, YAML accepts octal 0400. JSON does not support octal numeric literals, so use the decimal equivalent there. Choose a mode compatible with the container’s user and application; restrictive file permissions do not control who can otherwise access the Secret.
Plan for updates and rotation
When a Secret changes, Kubernetes propagates the new data to a mounted Secret volume eventually, rather than guaranteeing an immediate update. A Secret mounted using subPath does not receive automated updates. If an application relies on rotation, account for propagation delay and ensure it can reload or reopen the relevant files. See the Kubernetes Secrets and Volumes documentation.
Choose a direct Secret volume or a projected volume
For files from one Secret, a direct Secret volume is the simpler fit. A projected volume can combine multiple sources, including Secrets, ConfigMaps, and downward API data, into one directory. Its Secret source can map selected keys to paths. Choose based on how many sources the application needs and the directory layout it expects; see Projected Volumes.
What read-only mounting protects—and what it does not
Read-only means the container cannot write through that mount. It does not hide the mounted value from the process or from users able to read the file, and it does not prevent an authorized user from reading the Secret API object. Kubernetes documents that Secret objects are stored unencrypted in etcd by default; base64 encoding does not change that. Its security guidance recommends encryption at rest, least-privilege RBAC, and limiting Secret mounts or environment-variable references to the containers that need them. Treat Pod-creation privileges carefully: someone allowed to create Pods in a namespace may be able to arrange access to Secrets in that namespace. Applications must also protect values after reading them, including avoiding cleartext logs and untrusted transmission. See Kubernetes’ Secret security guidance.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
