---
id: "k8s-secret"
type: "component"
kind: "key-management"
provider: "k8s"
category: "security"
docs: "https://kubernetes.io/docs/concepts/configuration/secret/"
url: "https://localhost:3000/catalogue/components/k8s-secret"
---

# Secret

Small object holding a password, token or key, base64 encoded and stored unencrypted unless encryption at rest is enabled.

| | |
|---|---|
| Provider | [k8s](https://localhost:3000/catalogue?provider=k8s) |
| Kind | [Key management](https://localhost:3000/catalogue/kinds/key-management) |
| Category | Security |
| Official docs | [https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/) |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `base64Encoded` | boolean | — | no | true | inherited |
| `encryptionAtRest` | boolean | — | no | false | inherited |
| `envelopeEncryption` | boolean | — | no | false | **false** |
| `hsm` | boolean | — | no | false | **false** |
| `immutable` | boolean | — | no | false | inherited |
| `managed` | boolean | — | no | true | **false** |
| `maxSizeBytes` | integer | — | no | 1048576 | inherited |
| `rotationAutomated` | boolean | — | no | false | **false** |
| `rotationDays` | integer | — | no | — | inherited |
| `secretType` | enum | `opaque`, `service-account-token`, `docker-cfg`, `docker-config-json`, `basic-auth`, `ssh-auth`, `tls`, `bootstrap-token` | no | "opaque" | inherited |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 53

- [Certificate Management Service](https://localhost:3000/catalogue/components/alibaba-certificate-management.md) `alibaba-certificate-management` — alibabacloud
- [Data Encryption Service](https://localhost:3000/catalogue/components/alibaba-data-encryption-service.md) `alibaba-data-encryption-service` — alibabacloud
- [AWS Certificate Manager](https://localhost:3000/catalogue/components/aws-acm.md) `aws-acm` — aws
- [AWS KMS](https://localhost:3000/catalogue/components/aws-kms.md) `aws-kms` — aws
- [AWS Payment Cryptography](https://localhost:3000/catalogue/components/aws-payment-cryptography.md) `aws-payment-cryptography` — aws
- [AWS Private Certificate Authority](https://localhost:3000/catalogue/components/aws-private-ca.md) `aws-private-ca` — aws
- [AWS Secrets Manager](https://localhost:3000/catalogue/components/aws-secrets-manager.md) `aws-secrets-manager` — aws
- [AWS Signer](https://localhost:3000/catalogue/components/aws-signer.md) `aws-signer` — aws
- [AWS Systems Manager Parameter Store](https://localhost:3000/catalogue/components/aws-ssm-parameter-store.md) `aws-ssm-parameter-store` — aws
- [AWS CloudHSM](https://localhost:3000/catalogue/components/cloudhsm.md) `cloudhsm` — aws
- [Artifact Signing](https://localhost:3000/catalogue/components/azure-artifact-signing.md) `azure-artifact-signing` — azure
- [Azure Cloud HSM](https://localhost:3000/catalogue/components/azure-cloud-hsm.md) `azure-cloud-hsm` — azure
- [Azure Dedicated HSM](https://localhost:3000/catalogue/components/azure-dedicated-hsm.md) `azure-dedicated-hsm` — azure
- [Azure Key Vault](https://localhost:3000/catalogue/components/azure-key-vault.md) `azure-key-vault` — azure
- [Azure Key Vault Managed HSM](https://localhost:3000/catalogue/components/azure-managed-hsm.md) `azure-managed-hsm` — azure
- [Advanced Certificate Manager](https://localhost:3000/catalogue/components/cloudflare-advanced-certificate-manager.md) `cloudflare-advanced-certificate-manager` — cloudflare
- [Cloudflare Geo Key Manager](https://localhost:3000/catalogue/components/cloudflare-geo-key-manager.md) `cloudflare-geo-key-manager` — cloudflare
- [Cloudflare Keyless SSL](https://localhost:3000/catalogue/components/cloudflare-keyless-ssl.md) `cloudflare-keyless-ssl` — cloudflare
- [Cloudflare mTLS client certificates](https://localhost:3000/catalogue/components/cloudflare-mtls.md) `cloudflare-mtls` — cloudflare
- [Cloudflare Origin CA](https://localhost:3000/catalogue/components/cloudflare-origin-ca.md) `cloudflare-origin-ca` — cloudflare
- [Cloudflare Secrets Store](https://localhost:3000/catalogue/components/cloudflare-secrets-store.md) `cloudflare-secrets-store` — cloudflare
- [Cloudflare Universal SSL](https://localhost:3000/catalogue/components/cloudflare-ssl-tls.md) `cloudflare-ssl-tls` — cloudflare
- [Bitwarden](https://localhost:3000/catalogue/components/bitwarden.md) `bitwarden` — default
- [cert-manager](https://localhost:3000/catalogue/components/cert-manager.md) `cert-manager` — default
- [CyberArk Conjur](https://localhost:3000/catalogue/components/conjur.md) `conjur` — default
- [Doppler](https://localhost:3000/catalogue/components/doppler.md) `doppler` — default
- [EJBCA](https://localhost:3000/catalogue/components/ejbca.md) `ejbca` — default
- [Entrust nShield HSM](https://localhost:3000/catalogue/components/entrust-nshield.md) `entrust-nshield` — default
- [HashiCorp Vault](https://localhost:3000/catalogue/components/hashicorp-vault.md) `hashicorp-vault` — default
- [HCP Vault Dedicated](https://localhost:3000/catalogue/components/hcp-vault.md) `hcp-vault` — default
- [Infisical](https://localhost:3000/catalogue/components/infisical.md) `infisical` — default
- [Generic key management](https://localhost:3000/catalogue/components/key-management.md) `key-management` — default
- [1Password Connect](https://localhost:3000/catalogue/components/onepassword-connect.md) `onepassword-connect` — default
- [OpenBao](https://localhost:3000/catalogue/components/openbao.md) `openbao` — default
- [Sealed Secrets](https://localhost:3000/catalogue/components/sealed-secrets.md) `sealed-secrets` — default
- [Smallstep step-ca](https://localhost:3000/catalogue/components/step-ca.md) `step-ca` — default
- [Thales Luna HSM](https://localhost:3000/catalogue/components/thales-luna-hsm.md) `thales-luna-hsm` — default
- [Certificate Authority Service](https://localhost:3000/catalogue/components/google-certificate-authority-service.md) `google-certificate-authority-service` — gcp
- [Certificate Manager](https://localhost:3000/catalogue/components/google-certificate-manager.md) `google-certificate-manager` — gcp
- [Cloud External Key Manager](https://localhost:3000/catalogue/components/google-cloud-ekm.md) `google-cloud-ekm` — gcp
- and 13 more: https://localhost:3000/catalogue/kinds/key-management.md

## Use it in a design

```yaml
nodes:
  - { id: "k8s-secret", component: "k8s-secret" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Kubernetes Secret: a small object holding a password, token or key. Per "Secrets" the values are
# base64 encoded for convenience, not encrypted: they are stored unencrypted in etcd unless
# encryption at rest is enabled explicitly, and anyone with API access to the namespace -- or read
# access to etcd -- can retrieve them. The default type is Opaque, the cap is 1 MiB, and a Secret
# is mutable unless immutable: true is set. Kubernetes does not rotate Secret material.
schemaVersion: "1"
type: "component"
id: "k8s-secret"
kind: "key-management"
provider: "k8s"
docs: "https://kubernetes.io/docs/concepts/configuration/secret/"
defaults:
  managed: false
  hsm: false
  rotationAutomated: false
  envelopeEncryption: false
properties:
  encryptionAtRest:
    type: "boolean"
    default: false
  base64Encoded:
    type: "boolean"
    default: true
  secretType:
    type: "enum"
    values: ["opaque", "service-account-token", "docker-cfg", "docker-config-json", "basic-auth", "ssh-auth", "tls", "bootstrap-token"]
    default: "opaque"
  maxSizeBytes:
    type: "integer"
    default: 1048576
  immutable:
    type: "boolean"
    default: false
```

Human page: https://localhost:3000/catalogue/components/k8s-secret