Room 22

SECRETS

The Secret Keeper

Secrets store sensitive data like passwords, tokens, and certificates.
Decode the base64 secrets to find the escape password.

📜 Mission Briefing

Apply secret.yaml - creates a Secret with encoded data.
Read the secret: kubectl get secret escape-secret -o yaml.
The data values are base64-encoded. Decode the password field.
echo "<base64-value>" | base64 -d
The decoded value is secret64.

Key Commands

Command	Purpose
`kubectl create secret generic NAME --from-literal=key=val`	Create secret
`kubectl get secrets`	List secrets
`kubectl get secret NAME -o yaml`	View (base64 encoded)
`kubectl get secret NAME -o jsonpath='{.data.key}'`	Extract field

How Secrets Work

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  # Values must be base64 encoded
  username: YWRtaW4=           # echo -n "admin" | base64
  password: c2VjcmV0NjQ=       # echo -n "secret64" | base64
---
# stringData: Kubernetes base64-encodes for you
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:
  username: admin
  password: secret64

# Use secret as environment variables
spec:
  containers:
    - name: app
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password

# Mount as volume (files)
spec:
  containers:
    - name: app
      volumeMounts:
        - name: secret-vol
          mountPath: /etc/secrets
          readOnly: true
  volumes:
    - name: secret-vol
      secret:
        secretName: db-credentials

# Secret types:
# Opaque (default): arbitrary key-value pairs
# kubernetes.io/tls: TLS cert + key
# kubernetes.io/dockerconfigjson: Docker registry auth
# kubernetes.io/service-account-token: SA token

# Create secrets
kubectl create secret generic my-secret --from-literal=password=mypass
kubectl create secret tls tls-secret --cert=cert.pem --key=key.pem
kubectl create secret docker-registry regcred \
  --docker-server=registry.io \
  --docker-username=user \
  --docker-password=pass

# Decode
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 -d

# Note: Secrets are base64 encoded, NOT encrypted!
# For real encryption: enable EncryptionConfiguration on API server

Hints

Hint 1

View the secret:

kubectl get secret escape-secret -o yaml

Hint 2

Decode the password field:

kubectl get secret escape-secret -o jsonpath='{.data.password}' | base64 -d

Hint 3

The password is secret64.

🔓 Unlock Room 23

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_23/README             \
        -out ../room_23/README.txt        \
        -pass pass:PASSWORD
cat ../room_23/README.txt