<p>I've created a secret from a file using a command like:</p>

<pre><code>kubectl create secret generic laravel-oauth \
        --from-file=./.work-in-progress/oauth_private.key \
        --from-file=./.work-in-progress/oauth_public.key
</code></pre>

<p>However it seems new lines are stripped from the files (when using the secrets as ENV variables).</p>

<p>There is a 'encoding' note in the docs that state:</p>

<blockquote>
  <p>The serialized JSON and YAML values of secret data are encoded as
  base64 strings. Newlines are not valid within these strings and must
  be omitted. When using the base64 utility on Darwin/macOS users should
  avoid using the -b option to split long lines. Conversely Linux users
  should add the option -w 0 to base64 commands or the pipeline base64 |
  tr -d '\n' if -w option is not available.</p>
</blockquote>

<p>However I assumed this only applies for 'manually' created secrets via YAML files.</p>

Chris Stryczynski
<p>The new lines are not stripped the files are just <a href="https://en.wikipedia.org/wiki/Base64" rel="nofollow noreferrer">base64</a> encoded as mentioned in the other answers too. For example:</p>

<pre><code># mycert.pem
-----BEGIN CERTIFICATE-----
xxxxxx
xxxxxx
...
-----END CERTIFICATE-----
</code></pre>

<p>Then:</p>

<pre><code>$ kubectl create secret generic mysecret --from-file=./cert.pem
</code></pre>

<p>Then:</p>

<pre><code>$ kubectl get secret mysecret -o=yaml

apiVersion: v1
data:
  cert.pem: &lt;base64 encoded string&gt;
kind: Secret
metadata:
  creationTimestamp: 2018-11-14T18:11:46Z
  name: mysecret
  namespace: default
  resourceVersion: "20180431"
  selfLink: /api/v1/namespaces/default/secrets/mysecret
  uid: xxxxxx
type: Opaque
</code></pre>

<p>Then if you decode it, you will get the original secret.</p>

<pre><code>$ echo '&lt;base64 encoded string&gt;' | base64 -D
-----BEGIN CERTIFICATE-----
xxxxxx
xxxxxx
...
-----END CERTIFICATE-----
</code></pre>

<p>Also, this is not necessarily secure at rest. If you are looking for more security you can use something like <a href="https://www.vaultproject.io/" rel="nofollow noreferrer">Hashicorp Vault</a> or as alluded by @Alex <a href="https://github.com/bitnami-labs/sealed-secrets" rel="nofollow noreferrer">Bitnami's sealed secrets</a>.</p>
