What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For cloud-native workloads, a Kubernetes Secret is a convenient way to deliver sensitive values, but it is not encrypted in etcd by default. Protect secrets across their full lifecycle: restrict who and what can access them, secure storage and delivery, and make rotation work all the way through to the application.
The right pattern depends on your platform, workload identity, need for dynamic credentials, and how applications receive updates. Moving values to an external manager can centralize control, but does not remove the need for careful permissions, safe delivery, and pipeline hygiene.
What counts as a secret, and what does management cover?
A secret is sensitive authentication or encryption material: for example, an API key, password, database credential, or certificate. Managing it means controlling more than where it is stored. The lifecycle includes creation, storage, access, delivery to a workload, rotation or revocation, auditing, and removal.
CI/CD systems are part of that lifecycle. Their job credentials, logs, and access permissions can expose secrets, so apply scoped access and review how pipelines obtain and handle sensitive values. OWASP’s Secrets Management Cheat Sheet covers these practices.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Are Kubernetes Secrets encrypted?
Not by default when stored in etcd: Kubernetes Secret objects are stored unencrypted unless encryption at rest is configured. Kubernetes recommends enabling that protection and limiting access to Secret objects. Treat both the control plane and access to etcd as sensitive. Kubernetes’ guidance on good practices for Secrets describes these controls.
Secret values are represented in Kubernetes manifests and API responses using base64 encoding. Base64 is a representation format, not encryption; it does not prevent someone with sufficient access from reading the value. Encryption at rest and authorization solve different problems, so configure both rather than treating one as a substitute for the other.
In particular, scope permissions to the workloads and operators that need them. Review who can get, list, or watch Secret objects: broad permissions can reveal values beyond the specific Secret a user or service needs. Also control access to backups and infrastructure that can read etcd data.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which secret-delivery pattern fits a cloud-native workload?
There is no universally best storage pattern. Compare how each option fits your cloud and platform, how workload identity is established, whether values are copied into etcd, what rotation and audit controls are available, and who operates the system. The delivery method also matters: an updated value is useful only if the application can obtain and use it.
| Pattern | Where the workload gets the value | Key operational consideration |
|---|---|---|
| Kubernetes Secret object | From Kubernetes, commonly through a Pod’s configured Secret usage | Secure etcd with encryption at rest and scope Kubernetes access; the value remains in the Kubernetes storage path. |
| Cloud-provider secrets manager | From the provider’s service, using workload identity and narrowly scoped authorization | Configure identity and permissions for the specific workload and secret, then decide how the application receives and refreshes the value. |
| Dedicated manager such as Vault | Through the manager’s integration with the workload or platform | Consider whether centralized lifecycle control or dynamically generated credentials justify the operational ownership. |
| Secrets Store CSI Driver with an external store | Mounted into an authorized Pod as files | Some configurations also sync mounted values into Kubernetes Secret objects; when they do, Kubernetes and etcd storage controls still apply to that copy. |
Kubernetes-native Secrets
This is a direct option when Kubernetes is the intended delivery interface and the team can operate its storage and access controls. Configure encryption at rest, use narrowly scoped RBAC, protect etcd and its backups, and avoid putting secret values into source control or exposing them through pipeline output.
Cloud-provider secret managers
A managed service can centralize storage and lifecycle controls within a cloud environment. Its security still depends on the workload proving its identity and receiving only the permissions it needs. Confirm whether your integration reads values directly or copies them into Kubernetes; the latter reintroduces the Kubernetes storage considerations described above.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
AWS documents KMS-backed encryption at rest for Secrets Manager, unique data keys protected by KMS keys, optional customer-managed keys, and encrypted API transport in its data-protection documentation. Its Well-Architected guidance recommends removing, replacing, and rotating secrets as part of secure use. These are AWS-described capabilities and recommendations, not a comparative security assessment. Read AWS Well-Architected’s guidance on storing and using secrets securely.
Google documents encryption before persistence, AES-256 encryption at rest, secure HTTP(S) API communication, IAM controls, secret versioning, and optional customer-managed encryption keys. These descriptions are in its encryption documentation and Secret Manager overview.
Dedicated secret managers
A dedicated manager can be useful when teams need centralized lifecycle management across cloud providers or dynamic credentials. HashiCorp describes Vault as supporting dynamic generation and revocation of credentials for databases and cloud providers, as well as centralized distribution and lifecycle management of cloud-provider keys. Check current product documentation for the edition and plan you intend to use; those capabilities should not be assumed to be available identically in every offering. HashiCorp’s overview of managing third-party secrets explains its approach.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
External stores through the Secrets Store CSI Driver
The Secrets Store CSI Driver can mount values from an external store into authorized Pods. With Azure Key Vault on AKS, Microsoft documents an option to synchronize mounted content into a Kubernetes Secret as well as mounting it. If synchronization is enabled, account for the Kubernetes object and its etcd storage path when setting encryption and access controls. Microsoft’s AKS configuration guide documents the available configuration options.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you choose an approach?
Evaluate the complete path from secret creation to application use rather than comparing storage products in isolation. A short decision checklist helps expose gaps before rollout:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Platform fit: Does the pattern work with your Kubernetes distribution, cloud environment, and deployment model?
- Workload identity: Can each workload authenticate without embedding a long-lived credential, and can its authorization be limited to the specific secret it needs?
- Storage path: Is a value copied into a Kubernetes Secret or etcd, including through synchronization? If so, do Kubernetes storage controls cover that copy?
- Rotation behavior: Can you change or revoke the credential, refresh it in the delivery mechanism, and make the application switch to the new value?
- Auditability: Can you determine which identity accessed or changed a secret, and when?
- Operations and availability: Who owns the manager and its integration, and what happens to workloads if the service or connection is unavailable?
- Workload cost: Assess the total cost for your actual usage and operational needs; the cited technical documentation does not establish comparable prices or independent performance benchmarks.
Choose the simplest pattern that meets those requirements without weakening identity, authorization, delivery, or rotation. A centralized manager can help with lifecycle control, but it does not make an overly broad workload permission or an exposed CI pipeline safe.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do you rotate secrets without leaving applications on old values?
Rotation is an end-to-end change, not just an update to a secret store. A store can hold a new version while a workload continues using an old environment variable or a value cached in memory. Plan for the application to reload the value, read an updated file, or restart in a controlled way.
- Issue or replace the credential: Create the new credential or secret version in the source system, following the application’s and provider’s supported rotation process.
- Refresh delivery: Ensure the Kubernetes integration or mounted file receives the new value. Microsoft documents a default rotation polling interval of two minutes for the AKS Secrets Store CSI Driver configuration; this is a documented default for that configuration, not a universal Kubernetes or Key Vault guarantee. See the AKS rotation configuration.
- Make the application adopt it: File-based workloads need to detect and read updated files. Workloads that consume environment variables need a Pod restart to receive a refreshed value under the documented AKS setup.
- Verify, then revoke the old credential: Confirm the workload can authenticate using the replacement before removing the prior credential. This reduces the chance that an incomplete rollout becomes an outage.
Test the whole sequence, including what happens if a refresh fails or an application does not reload. Define an owner and a recovery path for each step; otherwise, rotation can update the store without changing the credential actually in use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
