<p>I am new to Kubernetes, and trying to wrap my head around how to set secrets. I will try to illustrate with an example. Let's say I have a secret resource that looks like:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: big-secrets
type: Opaque
data:
  secret-password: &quot;secretMeow&quot;
  secret-key: &quot;angryWoof&quot;
  database-password: &quot;happyWhale&quot;
</code></pre>
<p>How do I set up (not sure if set up is the right word here) these secrets using <code>kubectl</code>, and how do I retrieve them? I have tried reading through the following <a href="https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/" rel="nofollow noreferrer">documentation</a> but I am still not sure how to set up from a yaml file as mentioned above.</p>

alt-f4
<p>Using <code>stringData</code> it is possible to create a secret using plain text values:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: big-secrets
type: Opaque
stringData:
  secret-password: &quot;secretMeow&quot;
  secret-key: &quot;angryWoof&quot;
  database-password: &quot;happyWhale&quot;
</code></pre>
<p>However it's worth noting it's provided more for convenience and the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#secret-v1-core" rel="nofollow noreferrer">docs</a> say:</p>
<blockquote>
<p>It is provided as a write-only convenience method. All keys and values are merged into the data field on write, overwriting any existing values. It is never output when reading from the API.</p>
</blockquote>
<p>For the question of how to read the secret, if you wanted it programatically, you could use a tool like <code>jq</code> to parse the Kubernetes output and base64 decode:</p>
<pre><code>kubectl get secret big-secrets -o json | jq -r '.data[&quot;secret-password&quot;] | @base64d'
</code></pre>
<p>This would get the created secret as JSON (-o yaml is also an option), read the data field for a given secret (secret-password in this case) and then base64 decode it.</p>
