<p>Not really a programming question but quite curious to know how does Kubernetes or Minikube manage secrets &amp; uses it on multiple nodes/pods?</p>

<p>Let's say if I create a secret to pull image with <code>kubectl</code> as below - </p>

<pre><code>$ kubectl create secret docker-registry regsecret --docker-server=https://index.docker.io/v1/ --docker-username=$USERNM --docker-password=$PASSWD --docker-email=vivekyad4v@gmail.com
</code></pre>

<p>What processes will occur in the backend and how will k8s or Minikube use those on multiple nodes/pods?</p>

<p>All data in Kubernetes is managed by the <code>API Server</code> component that performs CRUD operations on the data store (current only option is <code>etcd</code>). </p>

<p>When you submit a <code>secret</code> with <code>kubectl</code> to the <code>API Server</code> it stores the resource and data in <code>etcd</code>. It is recommended to enable encryption for secrets in in the API Server (through setting the right flags) so that the data is encrypted at rest, otherwise anyone with access to <code>etcd</code> will be able to read your <code>secrets</code> in plain text.</p>

<p>When the <code>secret</code> is needed for either mounting in a <code>Pod</code> or in your example for pulling a Docker image from a private registry, it is requested from the <code>API Server</code> by the node-local <code>kubelet</code> and kept in <code>tmpfs</code> so it never touches any hard disk unencrypted.</p>

<p>Here another security recommendation comes into play, which is called Node Authorization (again set up by setting the right flags and distributing certificates to API Server and Kubelets). With Node Authorization enabled you can make sure that a <code>kubelet</code> can only request resources (incl. <code>secrets</code>) that are meant to be run on that specific node, so a hacked node just exposes the resources on that single node and not everything.</p>
