📄 YAMLmedium
2. base64 is NOT encryption
Write a Secret using the `data` field (not stringData). Values under `data` must be base64-encoded. The base64 of the string "admin" is: YWRtaW4= • apiVersion v1, kind Secret, metadata.name api-user, type Opaque • data.username: YWRtaW4=
How to approach this
The `data` field requires base64-ENCODED values — but base64 is an ENCODING, not encryption. Anyone can run `echo YWRtaW4= | base64 -d` and get back "admin" instantly. So a Kubernetes Secret is NOT protected by base64 alone; you still need etcd encryption at rest and tight RBAC. Getting a plaintext value into `data` is a bug — it must be base64.
config.yaml