How to Decode Kubernetes Secrets with Examples

Kubernetes secrets are used to store sensitive data securely. The data is encoded in base64 to avoid accidental exposure. However, this is not encryption; it’s merely an encoding to prevent unintentional reading. You must decode this data when you need to access the actual values.

Learn the best methods to decode Kubernetes secrets securely. Our guide covers command-line, YAML, and automation decoding. Start decoding now!

Create the Secret

1. Create a YAML configuration file to create a secret.

apiVersion: v1
kind: Secret
metadata:
  name: example-secret
type: Opaque
data:
  username: dXNlcm5hbWU=  # base64 for "username"
  password: cGFzc3dvcmQ=  # base64 for "password"

2. Save the above YAML to a file named example-secret.yaml and create the secret using kubectl:

 # kubectl apply -f example-secret.yaml

3. Use the kubectl get secret command to verify the secret creation:

 # kubectl get secret example-secret

Output.

NAME             TYPE     DATA   AGE
example-secret   Opaque   2      10s

Decoding Kubernetes Secrets

There are several ways you can decode a Kubernetes secret.

Method 1: Decoding from the Command Line

To decode the values of a Kubernetes secret, follow these steps:

1. Use kubectl get secret to retrieve the secret:

 # kubectl get secret example-secret -o jsonpath="{.data.username}" | base64 --decode

This command will output the decoded value of the username.

2. To get all data in a secret, you can use the following command:

 # kubectl get secret example-secret -o json | jq -r '.data | map_values(@base64d)'

This command retrieves all the data in the secret and decodes it using jq.

Practical Example

Let’s decode both username and password from our example secret.

1. Decode username:

 # kubectl get secret example-secret -o jsonpath="{.data.username}" | base64 --decode

Output.

username

2. Decode password:

 # kubectl get secret example-secret -o jsonpath="{.data.password}" | base64 --decode

Output.

password

Method 2: Decoding using a YAML Manifest

Sometimes, you might want to decode the secret values directly from the YAML manifest. Here’s how you can do it manually.

1. Retrieve the Secret YAML:

 # kubectl get secret example-secret -o yaml > decoded-secret.yaml

This command saves the secret to a file called decoded-secret.yaml.

2. Open decoded-secret.yaml and manually decode the base64 values using an online base64 decoder or a script. For example:

apiVersion: v1
kind: Secret
metadata:
  name: example-secret
type: Opaque
data:
  username: dXNlcm5hbWU=
  password: cGFzc3dvcmQ=

3. To decode base64 value “dXNlcm5hbWU=”, run:

 # base64 -d <<< dXNlcm5hbWU=

Output

username

4. To decode base64 value “cGFzc3dvcmQ=”, run:

 # base64 -d <<< dXNlcm5hbWU=

Output.

password

Method 3: Automating Decoding with a Script

To automate decoding, you can use a simple shell script. Here’s an example:

 # #!/bin/bash

SECRET_NAME=$1
NAMESPACE=$2

if [ -z "$SECRET_NAME" ] || [ -z "$NAMESPACE" ]; then
  echo "Usage: $0 secret_name namespace"
  exit 1
fi

kubectl get secret $SECRET_NAME -n $NAMESPACE -o json | jq -r '.data | map_values(@base64d)'

Save this script as decode-secret.sh, and make it executable.

 # chmod +x decode-secret.sh

Now, run this script.

 # ./decode-secret.sh example-secret default

Output.

{
  "username": "username",
  "password": "password"
}

Conclusion

Decoding Kubernetes secrets is straightforward once you understand the base64 encoding format used. Whether using kubectl commands, YAML files, or automation scripts, you can efficiently decode and access your secrets. This guide provides you with the tools and techniques to securely and effectively manage Kubernetes secrets.

FAQs

1. What is a Kubernetes secret?

A Kubernetes secret is an object used to store sensitive information such as passwords, tokens, or keys. The data is encoded in base64 format to prevent accidental exposure.

2. How is data stored in Kubernetes secrets?

Kubernetes stores secret data in base64-encoded format. However, this is not encryption, and the values must be decoded to access the actual data.

3. Can I decode all values in a Kubernetes secret at once?

Yes, you can use the command kubectl get secret secret_name -o json | jq -r '.data | map_values(@base64d)' to decode all the data in the secret.

4. How can I manually decode a secret from a YAML manifest?

You can retrieve the secret as YAML using kubectl get secret secret_name -o yaml, then manually decode the base64-encoded values using tools like an online decoder or the base64 command.