<p>I am fresh to Kubernetes. </p>

<p>My understanding of <code>secret</code> is that it encodes information by <code>base64</code>. And from the resources I have seen, it is claimed that <code>secret</code> could protect sensitive information. I do not get this. </p>

<p>Besides encoding information with <code>base64</code>, I do not see any real difference between <code>secret</code> and <code>configMap</code>. And we could decode <code>base64</code>-encoded information so easily. That means there is no protection at all... </p>

<p>Is my understanding wrong?</p>

Quan Zhou
<p>The thing which protects a <code>Secret</code> is the fact that it is a distinct resource type in kubernetes, and thus can be subject to a different RBAC policy than a <code>ConfigMap</code>.</p>

<p>If you are currently able to read <code>Secret</code>s in your cluster, that's because your <code>ClusterRoleBinding</code> (or <code>RoleBinding</code>) has a rule that specifically grants access to those resources. It can be due to you accessing the cluster through its "unauthenticated" port from one of the master Nodes, or due to the [<code>Cluster</code>]<code>RoleBinding</code> attaching your <code>Subject</code> to <code>cluster-admin</code>, which is probably pretty common in hello-world situations, but I would guess less common in production cluster setups.</p>

<p>That's the pedantic answer, however, <em>really</em> guarding the secrets contained in a <code>Secret</code> is trickier, given that they are usually exposed to the <code>Pod</code>s through environment injection or a volume mount. That means anyone who has <code>exec</code> access to the <code>Pod</code> can very easily exfiltrate the secret values, so if the secrets are super important, and must be kept even from the team, you'll need to revoke <code>exec</code> access to your <code>Pod</code>s, too. A middle ground may be to grant the team access to <code>Secret</code>s in their own <code>Namespace</code>, but forbid it from other <code>Namespace</code>s. It's security, so there's almost no end to the permutations and special cases.</p>
