Docs

Volcengine Kubernetes Engine

Configuration management

Creating Secrets

A Secret is an encrypted storage resource object designed to securely store sensitive data such as credentials, certificates, and private keys. By keeping this data out of images or pod definitions, Secrets enhance security while maintaining operational flexibility.‌

Procedure

Use the console

Create through YAML

In the left navigation bar, click Cluster.

In the cluster list, click the name of the target cluster.

In the left navigation pane of the cluster management page, click Configurations > Secret. On the Secret page, click Create Secret.

Parameter	Description
Name	Enter a name that follows the displayed naming rules. The name must be unique within the same namespace.
Namespace	Select a namespace where you want the Secret to belong. We recommend selecting a custom namespace or the system-created default namespace. For details about namespaces, see Namespace overview.
Type	Specify a Secret type: Key (Opaque): stores generic keys. If you select this option, you need to configure keys in the Configuration content section. You can do this using one of the following methods: Add key-value pair: set a key name and value in the Secret. You can include multiple key-value pairs in a Secret. Values can be empty, and no validation is performed. Upload local file: upload a local key configuration file. You can upload multiple files. warning For security reasons, uploading binary text via the console is not supported. However, you can use the kubectl command to upload binary text if necessary. For kubectl command details, see Kubernetes documentation. Repository key (Dockerconfigjson): stores credentials for accessing a private container image registry. You also need to set the following items: Repository address: the address of a private image repository, for example, cr-**-cn-beijing.cr.volces.com/demo/**. Username: the username for logging in to the private image repository. Password: The password for logging in to the private image repository. Certificate (TLS): stores certificates required by load balancers. You also need to set the following items: Upload certificate: upload a TLS certificate file. You can upload only one to a Secret of this type. Upload key: Upload a TLS key file. You can upload only one to a Secret of this type. warning After you create a Secret, you cannot change its type.
Tag	(Optional) Create Kubernetes labels to specify identifying attributes of this Secret. Click Add new and then enter a key-value pair that complies with the on-screen requirements.
Annotation	(Optional) Create Kubernetes annotations to attach non-identifying metadata to this Secret for efficient metadata retrieval. Annotations can contain characters that are not permitted in labels. Click Add annotation and then enter a key-value pair that complies with the on-screen requirements.

Click Confirm.

tip

Before you start, make sure that the following conditions are met:

The kubectl tool has been installed on your on-premises computer. For details, see Installing and configuring kubectl.

The target cluster has been connected through kubectl. For details, see Connecting to clusters.

Create the YAML file for the Secret.

tip

Multiple parameter values in the YAML file must be Base64-encoded. For Base64 encoding instructions, see FAQ.

The following is a sample YAML file for a Secret of type Opaque:

apiVersion: v1
kind: Secret
metadata:
name: secret-demo-opaque # The name of the Secret.
namespace: default # The namespace of the Secret.
data:
<your_key1>: <your_value1> # Key-value pair, where the value must be encoded in Base64.
<your_key1>: <your_value1> # Key-value pair, where the value must be encoded in Base64.
type: Opaque # The type of the Secret.

The following is a sample YAML file for a Secret of type Dockerconfigjson:

tip

In the following example, assume the registry domain name is example.com/demo/v1, the registry username is user1, and the password is acbd1234. You need to Base64-encode user1:abcd1234 first and use the encoded result as the auth value in Dockerconfigjson. For Base64 encoding instructions, see FAQ.

apiVersion: v1
kind: Secret
metadata:
name: secret-demo-dockerconf # The name of the Secret.
namespace: default # The namespace of the Secret.
type: kubernetes.io/dockerconfigjson # The type of the Secret.
stringData: # Authentication information for Dockerconfigjson.
.dockerconfigjson: |
{
"auths": {
"example.com/demo/v1": { # Registry domain name.
"username": "user1", # Registry username.
"password": "abcd1234", # Password.
"auth": "dXNlcjE6YWJjZDEyMzQ=" # The Base64-encoded result of "user1:abcd1234".
}
}
}

The following is a sample YAML file for a Secret of type TLS:

kind: Secret
apiVersion: v1
metadata:
name: secret-demo-tls # The name of the Secret.
namespace: default # The namespace of the Secret.
data:
tls.crt: ABC***** # Certificate content. It must be Base64-encoded.
tls.key: ABC***** # Private key content. It must be Base64-encoded.
type: kubernetes.io/tls # The type of the Secret.

Run the following command to create the Secret.

kubectl apply -f ${your_yaml_name}.yaml
## Replace ${your_yaml_name} with your YAML file name. A complete example is as follows:
## kubectl apply -f secret-demo.yaml

View the created Secret.

kubectl get secret -n default

The expected response is as follows:

NAME TYPE DATA AGE
1867e4e41c96**** Opaque 4 21d
190cf1c92349**** Opaque 4 20h

Results

After completing the operation, you can select the target namespace to view the created Secret in the Secret list.

Last updated: 2026.07.24 14:51:38