<p>I am a beginner to Kubernetes. I have created a secret file and referred it in deployment yaml file.</p>
<p>app-secret.yaml</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: app-secret
data:
  username: YWRtaW4=
  password: YWRtaW4=
</code></pre>
<p>deploy.yaml</p>
<pre><code>env:
          - name: DEPLOY_ENV
            value: ${env}
          - name: NAMESPACE_NAME
            valueFrom:
                fieldRef:
                  fieldPath : metadata.namespace
          - name: APP_USERNAME
            valueFrom:
                secretKeyRef:
                  name: app-secret
                  key: username
          - name: APP_PASSWORD
            valueFrom:
                secretKeyRef:
                  name: app-secret
                  key: password
</code></pre>
<p>While using the command <code>kubectl get secret pod-54rfxd -n dev-ns -o json</code>, it is printing the username and password in encoded format only. When i query for the environment variables list using the command <code>kubectl exec pod-54rfxd -n dev-ns -- printenv</code>, it was giving below result.</p>
<pre><code>APP_USERNAME=admin
APP_PASSWORD=admin
</code></pre>
<p>Why it was not in encoded format in environment variables. Could you please let me know the reason and is it possible to have it in encoded format?</p>

Varun
<p>Secret get stored with the <strong>base64</strong> <strong>encoded</strong> format when you create the secret. hile adding or injecting the secret into the pod or deployment Kubernetes by default decode the secret with <strong>base64</strong> so due to that you are getting the plain text from <strong>OS</strong> as environment variables.</p>
<p>there are some other option to <strong>encrypt</strong> at <strong>rest</strong> not <strong>encode</strong>.</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets</a></p>
<p><a href="https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengencryptingdata.htm" rel="nofollow noreferrer">https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengencryptingdata.htm</a></p>
<blockquote>
<p>is it possible to have it in encoded format?</p>
</blockquote>
<p>what you can do is to save the encoded .env file into secret and mount that file into the deployment path that <strong>.env</strong> file will be accessible to the application while content inside it will be encoded.</p>
<blockquote>
<p>kubectl exec pod-54rfxd -n dev-ns -- printenv</p>
</blockquote>
<p>this command only you can run maybe when you have admin permission of cluster otherwise not other can access inside the pod.</p>
