CKAD field manual
k8s Secret YAML example
stringData is plaintext in the file. Kubernetes stores it base64 in data. Prefer stringData on the exam.
kubectl create secret generic db --from-literal=password=example
kubectl create secret generic tls --from-file=tls.crt --from-file=tls.key
kubectl get secret db -o jsonpath='{.data.password}' | base64 -d
apiVersion: v1
kind: Secret
metadata:
name: db
namespace: default
type: Opaque
stringData:
password: example
username: app
spec:
containers:
- name: app
image: nginx:1.27
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db
key: password
envFrom:
- secretRef:
name: db
spec:
containers:
- name: app
image: nginx:1.27
volumeMounts:
- name: creds
mountPath: /etc/creds
readOnly: true
volumes:
- name: creds
secret:
secretName: db
Fields
- stringData
- Plaintext in the YAML. Stored as base64 in data. Prefer this.
- secretKeyRef
- One key. Not configMapKeyRef.
- secretName
- Volume field is secretName, not name.
- data
- Values here are already base64. Use stringData instead.
Watch
- Do not put a Secret in a ConfigMap. secretKeyRef / secretRef / secret.secretName — not configMap.
- data values are already base64. stringData is plaintext. Mixing both: stringData wins on the same key.
- kubectl get secret shows only keys. Decode: jsonpath '{.data.password}' | base64 -d.
Official docs Secrets