Kubernetes Secrets Explained With Simple Examples!

[Music] [Music] In this video, I'll explain how secrets In this video, I'll explain how secrets In this video, I'll explain how secrets work in Kubernetes and I'll give you work in Kubernetes and I'll give you work in Kubernetes and I'll give you some production patterns as well. What is a Kubernetes secret? It's well. What is a Kubernetes secret? It's a Kubernetes object with the kind secret a Kubernetes object with the kind secret a Kubernetes object with the kind secret which is designed to hold sensitive which is designed to hold sensitive which is designed to hold sensitive data. So I have my Kubernetes cluster data. So I have my Kubernetes cluster data. So I have my Kubernetes cluster here and if I do k get secret my secrets here and if I do k get secret my secrets here and if I do k get secret my secrets and then output that as yaml and when I and then output that as yaml and when I and then output that as yaml and when I run this command then I get the output run this command then I get the output run this command then I get the output of my secret object. So here you see of my secret object. So here you see of my secret object. So here you see this is kind secret and here is some this is kind secret and here is some this is kind secret and here is some secret data in here. So this data is secret data in here. So this data is secret data in here. So this data is stored as key value pairs as you see stored as key value pairs as you see stored as key value pairs as you see here password blah blah blah username here password blah blah blah username here password blah blah blah username blah blah blah. Now these values are blah blah blah. Now these values are blah blah blah. Now these values are base 64 encoded but that does not mean base 64 encoded but that does not mean base 64 encoded but that does not mean that they are encrypted. This is very that they are encrypted. This is very that they are encrypted. This is very important. This data although it might important. This data although it might important. This data although it might seem like gibberish to us humans, it's seem like gibberish to us humans, it's seem like gibberish to us humans, it's not actually encrypted. It's not not actually encrypted. It's not not actually encrypted. It's not actually secure. So if I run this actually secure. So if I run this actually secure. So if I run this command echo my command echo my command echo my password and pipe that to base 64 then password and pipe that to base 64 then password and pipe that to base 64 then what I get is a string of gibberish to what I get is a string of gibberish to what I get is a string of gibberish to us humans. This is base 64 encoded. It's us humans. This is base 64 encoded. It's us humans. This is base 64 encoded. It's encoded. It's not encrypted. So this I encoded. It's not encrypted. So this I encoded. It's not encrypted. So this I can actually decode very easily. So if I can actually decode very easily. So if I can actually decode very easily. So if I do echo and then take that value and do echo and then take that value and do echo and then take that value and then pipe that to base

then pipe that to base then pipe that to base 64 with the flag D then we see that I 64 with the flag D then we see that I 64 with the flag D then we see that I can decrypt this to my password very can decrypt this to my password very can decrypt this to my password very easily. So this is not secure at all. easily. So this is not secure at all. easily. So this is not secure at all. Yes, it protects me from when I'm Yes, it protects me from when I'm Yes, it protects me from when I'm sharing my screen and I'm for example sharing my screen and I'm for example sharing my screen and I'm for example showing a secret object. You should showing a secret object. You should showing a secret object. You should never do that but say it happens. Okay, never do that but say it happens. Okay, never do that but say it happens. Okay, then at least the humans cannot just then at least the humans cannot just then at least the humans cannot just read it, but you can very easily get the read it, but you can very easily get the read it, but you can very easily get the information that is encoded in the information that is encoded in the information that is encoded in the secret. So, it's obscured, but it's very secret. So, it's obscured, but it's very secret. So, it's obscured, but it's very easy easily reversible. But real easy easily reversible. But real easy easily reversible. But real security relies on CD encryption at security relies on CD encryption at security relies on CD encryption at rest. This is done in your cluster rest. This is done in your cluster rest. This is done in your cluster configuration or rolebased access configuration or rolebased access configuration or rolebased access control. So I'll I'll get I'll get into control. So I'll I'll get I'll get into control. So I'll I'll get I'll get into what that means a little bit later in what that means a little bit later in what that means a little bit later in the video, but let's just start with the video, but let's just start with the video, but let's just start with creating a simple secret. So to create a creating a simple secret. So to create a creating a simple secret. So to create a secret, you can use cubectl cubectl secret, you can use cubectl cubectl secret, you can use cubectl cubectl create secret and then the type of the create secret and then the type of the create secret and then the type of the secret is generic. There are several secret is generic. There are several secret is generic. There are several types like TLS certificates, but usually types like TLS certificates, but usually types like TLS certificates, but usually you'll use generic for just these kinds you'll use generic for just these kinds you'll use generic for just these kinds of key value pairs. The name is my of key value pairs. The name is my of key value pairs. The name is my secret and then we pass from literal secret and then we pass from literal secret and then we pass from literal username admin and from literal password username admin and from literal password username admin and from literal password is secret. So this is actually the is secret. So this is actually the is secret. So this is actually the command that I ran to create the secret command that I ran to create the secret command that I ran to create the secret that's already here. K get secret my that's already here. K get secret my that's already here. K get secret my secret. This is the command that's secret. This is the command that's secret. This is the command that's there. And I ran this command and this

there. And I ran this command and this there. And I ran this command and this created the secret that we see here. created the secret that we see here. created the secret that we see here. So this is one way of creating a secret. So this is one way of creating a secret. So this is one way of creating a secret. Another way is to use from file. So you Another way is to use from file. So you Another way is to use from file. So you can point this to a file for example can point this to a file for example can point this to a file for example config.json or SSH key and it's going to config.json or SSH key and it's going to config.json or SSH key and it's going to take the contents of that file and base take the contents of that file and base take the contents of that file and base 64 encode that into a secret 64 encode that into a secret 64 encode that into a secret object. Now you can check the secrets by object. Now you can check the secrets by object. Now you can check the secrets by using cubectl get secrets like we said. using cubectl get secrets like we said. using cubectl get secrets like we said. But if you want to see the contents of But if you want to see the contents of But if you want to see the contents of that secret then you pass o yl like that secret then you pass o yl like that secret then you pass o yl like this. And now we see the content of that this. And now we see the content of that this. And now we see the content of that secret. So let's see what the password secret. So let's see what the password secret. So let's see what the password is that's encoded here then. So if I do is that's encoded here then. So if I do is that's encoded here then. So if I do again I will do echo and then take that again I will do echo and then take that again I will do echo and then take that value pipe that to base value pipe that to base value pipe that to base 64 D and then we see it's secret like 64 D and then we see it's secret like 64 D and then we see it's secret like this just like we specified in the this just like we specified in the this just like we specified in the command over here secret. Now this is command over here secret. Now this is command over here secret. Now this is how you can create them with cubectl.

how you can create them with cubectl. how you can create them with cubectl. The second approach to creating secrets The second approach to creating secrets The second approach to creating secrets is using YAML files. So with Kubernetes, is using YAML files. So with Kubernetes, is using YAML files. So with Kubernetes, you usually are not running cubectl you usually are not running cubectl you usually are not running cubectl commands directly. You're actually commands directly. You're actually commands directly. You're actually deploying things from code. So here's an deploying things from code. So here's an deploying things from code. So here's an example of a secret file. So if I go to example of a secret file. So if I go to example of a secret file. So if I go to my Kubernetes cluster and if I do s.l my Kubernetes cluster and if I do s.l my Kubernetes cluster and if I do s.l like this and paste that in, then we like this and paste that in, then we like this and paste that in, then we have a secret object over here. Now I have a secret object over here. Now I have a secret object over here. Now I can apply this to my cluster. If I do k can apply this to my cluster. If I do k can apply this to my cluster. If I do k apply fs.yml YL then it has created my apply fs.yml YL then it has created my apply fs.yml YL then it has created my DB secret. So if I do k get secret my db DB secret. So if I do k get secret my db DB secret. So if I do k get secret my db secret o yl then we see that we have secret o yl then we see that we have secret o yl then we see that we have this db pass and db user over here. So this db pass and db user over here. So this db pass and db user over here. So that is how you would deploy kubernetes that is how you would deploy kubernetes that is how you would deploy kubernetes secrets from code. Now obviously this is secrets from code. Now obviously this is secrets from code. Now obviously this is not very secure because anyone who has not very secure because anyone who has not very secure because anyone who has access to this code can immediately get access to this code can immediately get access to this code can immediately get access to the values in there with B 64 access to the values in there with B 64 access to the values in there with B 64 decoding. So there there are ways of decoding. So there there are ways of decoding. So there there are ways of encoding this which will be in the next encoding this which will be in the next encoding this which will be in the next section of the video. But for now just section of the video. But for now just section of the video. But for now just remember that yes you can create secrets remember that yes you can create secrets remember that yes you can create secrets this way but this is not secure. But for this way but this is not secure. But for this way but this is not secure. But for demonstration purposes, we're just going demonstration purposes, we're just going demonstration purposes, we're just going to keep it this way for now. So there to keep it this way for now. So there to keep it this way for now. So there are several ways you can actually make are several ways you can actually make are several ways you can actually make use of these secrets or in other words use of these secrets or in other words use of these secrets or in other words consuming the secrets in pods. One, the consuming the secrets in pods. One, the consuming the secrets in pods. One, the first way is consuming them as

first way is consuming them as first way is consuming them as environment variables. So with this you environment variables. So with this you environment variables. So with this you would pass the value from secret key ref would pass the value from secret key ref would pass the value from secret key ref or en from secret key ref to your pod or en from secret key ref to your pod or en from secret key ref to your pod manifest. So let's check out what that manifest. So let's check out what that manifest. So let's check out what that looks like. So I'm going to copy looks like. So I'm going to copy looks like. So I'm going to copy this pod manifest here. And if I do this pod manifest here. And if I do this pod manifest here. And if I do pod.yml, paste that in. Now we have our pod.yml, paste that in. Now we have our pod.yml, paste that in. Now we have our pod manifest. So this has a container pod manifest. So this has a container pod manifest. So this has a container with the name my app container. It takes with the name my app container. It takes with the name my app container. It takes the busy box image and then it's going the busy box image and then it's going the busy box image and then it's going to echo the environment variable that we to echo the environment variable that we to echo the environment variable that we are setting in. And the environment are setting in. And the environment are setting in. And the environment variable is configured as follows. We variable is configured as follows. We variable is configured as follows. We set an enth object here. And then we set an enth object here. And then we set an enth object here. And then we create a list of environment variables. create a list of environment variables. create a list of environment variables. The first one is going to be app db The first one is going to be app db The first one is going to be app db user. And now the contents of that user. And now the contents of that user. And now the contents of that environment variable we are defining as environment variable we are defining as environment variable we are defining as follows. We say value from and then we follows. We say value from and then we follows. We say value from and then we we refer to a secret which is the secret we refer to a secret which is the secret we refer to a secret which is the secret that we just created the name my DB that we just created the name my DB that we just created the name my DB secret. And then inside of that secret secret. And then inside of that secret secret. And then inside of that secret there is a key called DB user and it's there is a key called DB user and it's there is a key called DB user and it's going to take that DB user key and store going to take that DB user key and store going to take that DB user key and store that into the environment variable. So that into the environment variable. So that into the environment variable. So that is how that works. So if I deploy that is how that works. So if I deploy that is how that works. So if I deploy this pod and if I check my pods now here we pod and if I check my pods now here we see that we have one pod running and if see that we have one pod running and if see that we have one pod running and if I check the logs of I check the logs of I check the logs of this then we see that my username is this then we see that my username is this then we see that my username is admin. So it has successfully injected

admin. So it has successfully injected admin. So it has successfully injected that secret into the container, decoded that secret into the container, decoded that secret into the container, decoded it, and now I'm able to access that from it, and now I'm able to access that from it, and now I'm able to access that from within my container. So if I open up K9s within my container. So if I open up K9s within my container. So if I open up K9s and if I open a shell here and I press and if I open a shell here and I press and if I open a shell here and I press en then we see that this environment en then we see that this environment en then we see that this environment variable app DB user has the contents of variable app DB user has the contents of variable app DB user has the contents of admin like this just like we configured. admin like this just like we configured. admin like this just like we configured. Now if I delete that pod and if I then open up my YAML again, pod and if I then open up my YAML again, I can also do a different approach where I can also do a different approach where I can also do a different approach where I do an N from here. So N from is I do an N from here. So N from is I do an N from here. So N from is basically going to take everything basically going to take everything basically going to take everything that's in the secret my DB secret and that's in the secret my DB secret and that's in the secret my DB secret and inject that as environment variables. So inject that as environment variables. So inject that as environment variables. So earlier we only had the DB user key or earlier we only had the DB user key or earlier we only had the DB user key or the the DB user environment variable the the DB user environment variable the the DB user environment variable here app DB user but now let's see what here app DB user but now let's see what here app DB user but now let's see what happens when I do it like this. So I happens when I do it like this. So I happens when I do it like this. So I close it I apply the pod again and let's close it I apply the pod again and let's close it I apply the pod again and let's check out the logs. So now it's not check out the logs. So now it's not check out the logs. So now it's not outputting the contents of the outputting the contents of the outputting the contents of the environment variable correctly because environment variable correctly because environment variable correctly because it has changed. Because if we do k get it has changed. Because if we do k get it has changed. Because if we do k get secret my db secret o yl we see that the secret my db secret o yl we see that the secret my db secret o yl we see that the the key is different. It's not the same the key is different. It's not the same the key is different. It's not the same environment variable that we are environment variable that we are environment variable that we are creating over here app db user which is creating over here app db user which is creating over here app db user which is then used in the script over here. But then used in the script over here. But then used in the script over here. But if I enter the if I enter the if I enter the container and if I do enth then we see

container and if I do enth then we see container and if I do enth then we see that we have our DB user that we have our DB user that we have our DB user um environment variable set like this um environment variable set like this um environment variable set like this and our DB pass is now set like this. So and our DB pass is now set like this. So and our DB pass is now set like this. So we have both of our secrets available to we have both of our secrets available to we have both of our secrets available to us in environment variables. Now you us in environment variables. Now you us in environment variables. Now you might be thinking well if you can might be thinking well if you can might be thinking well if you can describe the pod then then you will describe the pod then then you will describe the pod then then you will actually see the cont the the contents actually see the cont the the contents actually see the cont the the contents right? Well let's check it out. If I k right? Well let's check it out. If I k right? Well let's check it out. If I k describe pod and then pipe that to vim. describe pod and then pipe that to vim. describe pod and then pipe that to vim. So I can easily scroll through it. Here So I can easily scroll through it. Here So I can easily scroll through it. Here we see that the environment variables it we see that the environment variables it we see that the environment variables it has detected or it's describing that it has detected or it's describing that it has detected or it's describing that it has the environment variables from this has the environment variables from this has the environment variables from this secret. However, it's not printing out secret. However, it's not printing out secret. However, it's not printing out the contents of that secret in the the contents of that secret in the the contents of that secret in the description. So this is a safe way of description. So this is a safe way of description. So this is a safe way of handling secrets in your containers by handling secrets in your containers by handling secrets in your containers by injecting them as environment variables. injecting them as environment variables. injecting them as environment variables. And this is actually according to the 12 And this is actually according to the 12 And this is actually according to the 12 factor app. If you know what that is, factor app. If you know what that is, factor app. If you know what that is, this is a basically a standard that I this is a basically a standard that I this is a basically a standard that I always recommend that people learn always recommend that people learn always recommend that people learn especially if you're a DevOps engineer.

especially if you're a DevOps engineer. especially if you're a DevOps engineer. It's a set of practices and one of them It's a set of practices and one of them It's a set of practices and one of them is that you define your config and your is that you define your config and your is that you define your config and your secrets in environment variables and secrets in environment variables and secrets in environment variables and it's considered to be a secure way of it's considered to be a secure way of it's considered to be a secure way of doing it. Now the second way how you can doing it. Now the second way how you can doing it. Now the second way how you can consume secrets into pods is using them consume secrets into pods is using them consume secrets into pods is using them as mounts. So let's check out how that as mounts. So let's check out how that as mounts. So let's check out how that works. Let's open up a pod.l again and works. Let's open up a pod.l again and works. Let's open up a pod.l again and paste that in. So now we have some now paste that in. So now we have some now paste that in. So now we have some now we have something different. Now we have we have something different. Now we have we have something different. Now we have a different command. But first let's a different command. But first let's a different command. But first let's take a look at these volumes. So here take a look at these volumes. So here take a look at these volumes. So here what I'm doing is I'm mounting the what I'm doing is I'm mounting the what I'm doing is I'm mounting the secret with secret name my DB secret to secret with secret name my DB secret to secret with secret name my DB secret to a volume called secret storage. Then I a volume called secret storage. Then I a volume called secret storage. Then I define a volume mount object in my pod define a volume mount object in my pod define a volume mount object in my pod manifest. And here I'm saying you must manifest. And here I'm saying you must manifest. And here I'm saying you must take the secret storage volume that's take the secret storage volume that's take the secret storage volume that's defined over here, mount that in Etsy defined over here, mount that in Etsy defined over here, mount that in Etsy secrets and then set that to read only secrets and then set that to read only secrets and then set that to read only because you don't want to be messing because you don't want to be messing because you don't want to be messing with secrets from within your container. with secrets from within your container. with secrets from within your container. So if I now delete the old pod again and if I apply the new updated again and if I apply the new updated manifest. Now we see that our pod is now manifest. Now we see that our pod is now manifest. Now we see that our pod is now being created.

being created. being created. And now when I check the logs of that pod, we see that it has checking secrets pod, we see that it has checking secrets and then it's outputting the DB pass and and then it's outputting the DB pass and and then it's outputting the DB pass and DB user. So what this command is doing DB user. So what this command is doing DB user. So what this command is doing is it's doing an ls of the EC secrets is it's doing an ls of the EC secrets is it's doing an ls of the EC secrets that we defined over here. So it's here that we defined over here. So it's here that we defined over here. So it's here showing the the contents of the showing the the contents of the showing the the contents of the directory that we create mount that we directory that we create mount that we directory that we create mount that we mounting over here. So because it is mounting over here. So because it is mounting over here. So because it is showing DB pass and DB user, we know showing DB pass and DB user, we know showing DB pass and DB user, we know that there are two files here called DB that there are two files here called DB that there are two files here called DB pass and DB user. So if I exec into the pass and DB user. So if I exec into the pass and DB user. So if I exec into the container again and if I go to Etsy container again and if I go to Etsy container again and if I go to Etsy secrets then we see that there are two secrets then we see that there are two secrets then we see that there are two files here and if I cat them then I can files here and if I cat them then I can files here and if I cat them then I can do DB pass I get the contents of the DB do DB pass I get the contents of the DB do DB pass I get the contents of the DB pass file and if I do cat DB pass file and if I do cat DB pass file and if I do cat DB user then I get the contents of the DB user then I get the contents of the DB user then I get the contents of the DB user file and these files are then user file and these files are then user file and these files are then mapped to the secret object that we mapped to the secret object that we mapped to the secret object that we defined earlier. Right? So this is the defined earlier. Right? So this is the defined earlier. Right? So this is the second way how you can consume secrets second way how you can consume secrets second way how you can consume secrets inside pods and how your applications inside pods and how your applications inside pods and how your applications can make use of them. So they can either can make use of them. So they can either can make use of them. So they can either pull the secrets from the environment pull the secrets from the environment pull the secrets from the environment which I prefer according to the 12 which I prefer according to the 12 which I prefer according to the 12 factor app methodology or you can read factor app methodology or you can read factor app methodology or you can read them from the disk as I just showed you.

them from the disk as I just showed you. them from the disk as I just showed you. So this is how Kubernetes secret objects So this is how Kubernetes secret objects So this is how Kubernetes secret objects work. You can have sensitive values in work. You can have sensitive values in work. You can have sensitive values in secret objects and then consume them secret objects and then consume them secret objects and then consume them inside pods this way. But again, what inside pods this way. But again, what inside pods this way. But again, what I've showed you is not necessarily I've showed you is not necessarily I've showed you is not necessarily secure. It's more secure than having it secure. It's more secure than having it secure. It's more secure than having it in just plain text, but it's not secure. in just plain text, but it's not secure. in just plain text, but it's not secure. Base 64 is not encryption. Anyone who Base 64 is not encryption. Anyone who Base 64 is not encryption. Anyone who can read the who can read the secret can read the who can read the secret can read the who can read the secret object can also decode it. How you would object can also decode it. How you would object can also decode it. How you would limit this is first of all is you use limit this is first of all is you use limit this is first of all is you use role-based access control. So you use role-based access control. So you use role-based access control. So you use service accounts and users and then you service accounts and users and then you service accounts and users and then you limit which users and service accounts limit which users and service accounts limit which users and service accounts can actually get access to those can actually get access to those can actually get access to those secrets. So cluster users should not secrets. So cluster users should not secrets. So cluster users should not have open um open field to all secrets have open um open field to all secrets have open um open field to all secrets right like maybe their own name space right like maybe their own name space right like maybe their own name space but you don't want to have um full but you don't want to have um full but you don't want to have um full access to all secrets over your entire access to all secrets over your entire access to all secrets over your entire cluster for example if you have cluster for example if you have cluster for example if you have multiple users in your cluster. Another multiple users in your cluster. Another multiple users in your cluster. Another thing is CD encryption at rest. So by thing is CD encryption at rest. So by thing is CD encryption at rest. So by default at CD which is like the brain of default at CD which is like the brain of default at CD which is like the brain of your cluster where everything is stored your cluster where everything is stored your cluster where everything is stored in key value pairs by default this is in key value pairs by default this is in key value pairs by default this is not configured to store it encrypted and not configured to store it encrypted and not configured to store it encrypted and this is what you learn in the CKS exam this is what you learn in the CKS exam this is what you learn in the CKS exam for example I have this I'm a cubernaut for example I have this I'm a cubernaut for example I have this I'm a cubernaut and one of the tasks here it's a cluster and one of the tasks here it's a cluster and one of the tasks here it's a cluster admin task is to learn how to encrypt CD admin task is to learn how to encrypt CD admin task is to learn how to encrypt CD secrets at rest. So even though I might secrets at rest. So even though I might secrets at rest. So even though I might not have access to your namespace, if

not have access to your namespace, if not have access to your namespace, if I'm a cluster administrator and I have I'm a cluster administrator and I have I'm a cluster administrator and I have access to CCD and it's not encrypted, access to CCD and it's not encrypted, access to CCD and it's not encrypted, then I can just easily read out all of then I can just easily read out all of then I can just easily read out all of the secret information from there. Now the secret information from there. Now the secret information from there. Now there are of course a few limitations there are of course a few limitations there are of course a few limitations with if you are just using secret with if you are just using secret with if you are just using secret objects like this. So manual rotation is objects like this. So manual rotation is objects like this. So manual rotation is needed. So you would have to if you needed. So you would have to if you needed. So you would have to if you change the secret you would have to change the secret you would have to change the secret you would have to update the secret object and then update the secret object and then update the secret object and then restart your deployments. your base 64 restart your deployments. your base 64 restart your deployments. your base 64 is visible in the YAML and API is visible in the YAML and API is visible in the YAML and API responses. So you need rolebased access responses. So you need rolebased access responses. So you need rolebased access control and there's a potential sprawl control and there's a potential sprawl control and there's a potential sprawl across namespaces and cluster right if across namespaces and cluster right if across namespaces and cluster right if you're just creating secret objects you're just creating secret objects you're just creating secret objects everywhere there's not really a central everywhere there's not really a central everywhere there's not really a central registry for these production patterns registry for these production patterns registry for these production patterns so how how this would work in actual so how how this would work in actual so how how this would work in actual deployments is encrypting secrets in git deployments is encrypting secrets in git deployments is encrypting secrets in git using H and this is what what I teach in using H and this is what what I teach in using H and this is what what I teach in my Kubernetes home lab course. So, the my Kubernetes home lab course. So, the my Kubernetes home lab course. So, the Kubernetes Home Lab course is a a course Kubernetes Home Lab course is a a course Kubernetes Home Lab course is a a course that comes after my fundamentals. This that comes after my fundamentals. This that comes after my fundamentals. This is an 8-hour course that's going to show is an 8-hour course that's going to show is an 8-hour course that's going to show you how to set up a Kubernetes home lab you how to set up a Kubernetes home lab you how to set up a Kubernetes home lab from scratch, but using GitOps theory from scratch, but using GitOps theory from scratch, but using GitOps theory and going deep into security as well.

and going deep into security as well. and going deep into security as well. And in this course, we are using the And in this course, we are using the And in this course, we are using the SOPs integration of Flux CD. So this SOPs integration of Flux CD. So this SOPs integration of Flux CD. So this course will will teach you how to handle course will will teach you how to handle course will will teach you how to handle secrets from code so you can safely secrets from code so you can safely secrets from code so you can safely commit them. If you join today, you get commit them. If you join today, you get commit them. If you join today, you get access to 40 plus hours of more courses access to 40 plus hours of more courses access to 40 plus hours of more courses about becoming a DevOps engineer with a about becoming a DevOps engineer with a about becoming a DevOps engineer with a Kubernetes focus. You get access to a Kubernetes focus. You get access to a Kubernetes focus. You get access to a community of almost 600 DevOps engineers community of almost 600 DevOps engineers community of almost 600 DevOps engineers who are all very active like I'm I'm who are all very active like I'm I'm who are all very active like I'm I'm active here every day. And if you have active here every day. And if you have active here every day. And if you have any questions, if you get stuck in your any questions, if you get stuck in your any questions, if you get stuck in your learning, you can ask me questions learning, you can ask me questions learning, you can ask me questions directly either through posts or by directly either through posts or by directly either through posts or by joining one of the Q&A calls. So I joining one of the Q&A calls. So I joining one of the Q&A calls. So I highly recommend you check that out. I highly recommend you check that out. I highly recommend you check that out. I think you might like it. The next think you might like it. The next think you might like it. The next pattern is the external secrets pattern is the external secrets pattern is the external secrets operator. So this is a controller that operator. So this is a controller that operator. So this is a controller that syncs secrets from external managers. So syncs secrets from external managers. So syncs secrets from external managers. So you can for example store your secrets you can for example store your secrets you can for example store your secrets in Hashi Corp vault in Azure key vaults in Hashi Corp vault in Azure key vaults in Hashi Corp vault in Azure key vaults in AWS secrets manager or GCP secret in AWS secrets manager or GCP secret in AWS secrets manager or GCP secret managers and then you have your let's managers and then you have your let's managers and then you have your let's say Azure key volt you store your say Azure key volt you store your say Azure key volt you store your secrets in there and then the external secrets in there and then the external secrets in there and then the external secrets operator is going to pull those secrets operator is going to pull those secrets operator is going to pull those in and create the Kubernetes secret in and create the Kubernetes secret in and create the Kubernetes secret objects for you. So this is a very clean objects for you. So this is a very clean objects for you. So this is a very clean way of of handling secrets. This is way of of handling secrets. This is way of of handling secrets. This is actually also what I do in my home lab.

actually also what I do in my home lab. actually also what I do in my home lab. And why this is good is it's it And why this is good is it's it And why this is good is it's it centralizes the management. So you have centralizes the management. So you have centralizes the management. So you have your single source of truth in your your single source of truth in your your single source of truth in your Azure key volt. For Azure key volt. For Azure key volt. For example, you can leverage the mature example, you can leverage the mature example, you can leverage the mature external secret stores and their external secret stores and their external secret stores and their features. So if I have my Azure key features. So if I have my Azure key features. So if I have my Azure key volt, then first of all, it's completely volt, then first of all, it's completely volt, then first of all, it's completely redundant. So I I I can be 100% sure redundant. So I I I can be 100% sure redundant. So I I I can be 100% sure that my secrets are never going to get that my secrets are never going to get that my secrets are never going to get lost. I can use Azure key volt secret lost. I can use Azure key volt secret lost. I can use Azure key volt secret rotation so I can automatically rotate rotation so I can automatically rotate rotation so I can automatically rotate my secrets and I can use auditing so I my secrets and I can use auditing so I my secrets and I can use auditing so I can have certain standards for my can have certain standards for my can have certain standards for my secrets from there and this really secrets from there and this really secrets from there and this really greatly improves your security posture. greatly improves your security posture. greatly improves your security posture. So this is what I actually use in my own So this is what I actually use in my own So this is what I actually use in my own home lab as well. And what I recommend home lab as well. And what I recommend home lab as well. And what I recommend uh the soaps way is an easy start to get uh the soaps way is an easy start to get uh the soaps way is an easy start to get to wrap your mind around it. And then to wrap your mind around it. And then to wrap your mind around it. And then when you uh when you have learned that when you uh when you have learned that when you uh when you have learned that then I recommend going to the external then I recommend going to the external then I recommend going to the external secrets operator. And a full demo of secrets operator. And a full demo of secrets operator. And a full demo of this is out of scope for this beginner this is out of scope for this beginner this is out of scope for this beginner video, but this is the way forward in my video, but this is the way forward in my video, but this is the way forward in my opinion. And in CubeCraft, I also of opinion. And in CubeCraft, I also of opinion. And in CubeCraft, I also of course share my complete setup for the course share my complete setup for the course share my complete setup for the external secrets operator like I did in external secrets operator like I did in external secrets operator like I did in my home lab. And lastly, if you're using my home lab. And lastly, if you're using my home lab. And lastly, if you're using managed Kubernetes services, for managed Kubernetes services, for managed Kubernetes services, for example, Azure Kubernetes service, then example, Azure Kubernetes service, then example, Azure Kubernetes service, then very often they will have integrations very often they will have integrations very often they will have integrations of for syncing your secrets from, for of for syncing your secrets from, for of for syncing your secrets from, for example, Azure Key Volts into that example, Azure Key Volts into that example, Azure Key Volts into that Kubernetes cluster. So your cloud Kubernetes cluster. So your cloud Kubernetes cluster. So your cloud environment is very likely to offer some

environment is very likely to offer some environment is very likely to offer some kind of secret rotation and syncing as kind of secret rotation and syncing as kind of secret rotation and syncing as well if it's a well-designed product. So well if it's a well-designed product. So well if it's a well-designed product. So there you have it. That's the there you have it. That's the there you have it. That's the introduction to Kubernetes secrets for introduction to Kubernetes secrets for introduction to Kubernetes secrets for beginners. If you want access to this beginners. If you want access to this beginners. If you want access to this file and want to read through it and get file and want to read through it and get file and want to read through it and get all of the commands and if you want to all of the commands and if you want to all of the commands and if you want to if you have more questions and want to if you have more questions and want to if you have more questions and want to get more information, make sure to jump get more information, make sure to jump get more information, make sure to jump in my in my community in my in my community in my in my community school.com/cq. And I hope to see you school.com/cq. And I hope to see you school.com/cq. And I hope to see you there. Thank you so much for watching there. Thank you so much for watching there. Thank you so much for watching and see you in the next