<p>Why does k8s secrets need to be base64 encoded when configmaps does not?</p>

<p>When creating a configmap you simply do somthing like this:</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
data:
  SOME_KEY: a string value
</code></pre>

<p>But when you want to create a secret you have to 
<code>echo -n "some secret string" | base64</code> and then put the result of that in a file looking something like this:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  SOME_KEY: c29tZSBzZWNyZXQgc3RyaW5n
</code></pre>

<p>I really wonder why there is this difference? Are kubernetes secrets simply base64 encoded strings? I would expect that secrets were stored encrypted in kubernetes. </p>

<p>Secrets can contain binary data (the type is <code>map[string][]byte</code>), and byte arrays are base64-encoded in JSON serialization.</p>

<p>ConfigMaps only contain string data (the type is <code>map[string]string</code>), so the JSON serialization just outputs the string.</p>

<p>In 1.10, ConfigMaps have a new <code>binaryData</code> field that allows storing binary data, which is base64-encoded, just like secrets. <a href="https://github.com/kubernetes/kubernetes/pull/57938" rel="noreferrer">https://github.com/kubernetes/kubernetes/pull/57938</a></p>
