<p>I have set up Kubernetes secrets.</p>

<pre><code>kubectl create secret generic mysecret --from-file=mysecret=/home/ubuntu/secret.txt
</code></pre>

<p>And this secret can be converted to plaintext using the same <code>kubectl</code> command:</p>

<pre><code>kubectl get secret mysecret -o yaml
# and base64 decode
</code></pre>

<p>How do I limit access to this secret? I only want a certain pods and only me as an operator to have access to this secret.</p>

<p>OK, so you need to define a (cluster) role and then bind it to you (== human user is the target entity) and/or to a service account (== app is the target entity) which you then <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="noreferrer">use in the pod</a> instead of the <code>default</code> one.</p>

<p>The respective <code>secretadmin</code> role (or choose whatever name you prefer) would look something like this (vary verbs as required):</p>

<pre><code>$ kubectl create clusterrole secretadmin \
          --verb=get --verb=list --verb=create --verb=update  \
          --resource=secret \
          --namespace=mysuperproject
</code></pre>

<p>Once you've defined the role, you can attach (or: bind) it to a certain entity. Let's go through the case of the service account (similar then for a human user, just simpler). So first we need to create the service account, here called <code>thepowerfulapp</code> which you will then use in your deployment/pod/whatever:</p>

<pre><code>$ kubectl -n mysuperproject create sa thepowerfulapp
</code></pre>

<p>And now it's time to tie everything together with the following binding called <code>canadminsecret</code></p>

<pre><code>$ kubectl create clusterrolebinding canadminsecret \
          --role=secretadmin \
          --serviceaccount=mysuperproject:thepowerfulapp \
          --namespace=mysuperproject
</code></pre>
