<p>I am trying to avoid kubernetes secrets view-able by any user.
I tried sealed secrets, but that is just hiding secrets to be stored in version control.
As soon as I apply that secret, I can see the secret using the below command.</p>

<pre><code>kubectl get secret mysecret -o yaml
</code></pre>

<p>This above command is still showing base64 encoded form of secret.</p>

<p>How do I avoid someone seeing the secret ( even in base64 format) with the above simple command.</p>

<p>You can use Hashicrop Vault or kubernetes-external-secrets (<a href="https://github.com/godaddy/kubernetes-external-secrets" rel="nofollow noreferrer">https://github.com/godaddy/kubernetes-external-secrets</a>).</p>

<p>Or if you just want to restrict only, then you should create a read-only user and restrict the access for the secret for the read-only user using role &amp; role binding.</p>

<p>Then if anyone tries to describe secret then it will throw access denied error.</p>

<p>Sample code:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: test-secrets
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-secrets
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-secrets
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: demo
</code></pre>

<p>The above role has no access to secrets. Hence the demo user gets access denied.</p>
