<p>I can easily get the secrets stored in <code>Kubernetes</code>.</p>

<pre><code>$ kubectl get secret my-app-secrets -o yaml
</code></pre>

<p>Select secret value from output that I want to decode. </p>

<p>Example <code>ZXhwb3NlZC1wYXNzd29yZAo=</code></p>

<pre><code>$ echo ZXhwb3NlZC1wYXNzd29yZAo= | base64 --decode
&gt; exposed-password
</code></pre>

<p>I'm not sure I understand the effectiveness of the secrets resources in <code>Kubernetes</code> ecosystem since it's easy to obtain this.</p>

<p><a href="https://stackoverflow.com/questions/10315757/what-is-the-real-purpose-of-base64-encoding">base64</a> is encoding, not encryption, it allows you to simply encode information in a convenient way.</p>

<p>The data that you encode may contain many unrecognized characters, line feeds, etc., so it is convenient to encode them.</p>

<p>In kubernetes, you can enable encryption using this <a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="noreferrer">instruction</a>.</p>

<p>But kubernetes should not be the only source of truth, rather kubernetes loads these secrets from an external vault that you need to select, such as <a href="https://www.vaultproject.io" rel="noreferrer">hashicorp's vault</a>, as indicated in the comments.</p>

<p>In addition to hashicorp vault, there are various ways to store secrets in git:</p>

<ul>
<li><a href="https://github.com/zendesk/helm-secrets" rel="noreferrer">Helm secrets</a></li>
<li><a href="https://kamus.soluto.io" rel="noreferrer">Kamus</a></li>
<li><a href="https://github.com/bitnami-labs/sealed-secrets" rel="noreferrer">Sealed secrets</a></li>
<li><a href="https://github.com/AGWA/git-crypt" rel="noreferrer">git-crypt</a></li>
</ul>

<p>You may also be interested in the <a href="https://kubesec.io" rel="noreferrer">kubesec</a> project, which can be used to analyze kubernetes resources for security risks.</p>
