<p>According to the <a href="http://kubernetes.io/v1.1/docs/user-guide/secrets.html#creating-a-secret-manually" rel="nofollow">Kubernetes secrets docs</a>, creating a secret is as easy as base64-encoding the data and placing it in a file.</p>

<p>How then, if base64 can be decoded as easily as it's encoded, can we secure/encrypt the secret values in the file? It would be nice to be able to commit the secret files into source control, however simply committing the file with base64-encoded data is in no way secure.</p>

<p>For example, here is the example given in the docs:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  password: dmFsdWUtMg0K
  username: dmFsdWUtMQ0K
</code></pre>

<p>If you went to <a href="http://base64decode.org" rel="nofollow">base64decode.org</a>, you would see that those password/username values simply are "value-2". This file is unfit for source control. How can we secure the data in the file so that it is safe for source control? Or is this considered bad practice, and we should just add the file to .gitignore?</p>

<p>It isn't base64 encoded for security, it is to allow binary content to be stored in secrets. You likely should not commit secret definitions to source control. </p>
