# Demonstration: A Secret Is Encoded, Not Encrypted

## Creating a Secret

```
$ kubectl create secret generic app-secret --from-literal=api-key=supersecret
secret/app-secret created
```

## Looking at it

```
$ kubectl get secret app-secret -o yaml
apiVersion: v1
kind: Secret
metadata:
  name: app-secret
data:
  api-key: c3VwZXJzZWNyZXQ=
type: Opaque
```

## Decoding it — no special permission needed beyond reading the Secret itself

```
$ echo "c3VwZXJzZWNyZXQ=" | base64 -d
supersecret
```

Anyone who can run `kubectl get secret app-secret -o yaml` (i.e. anyone RBAC allows to READ
Secrets in this Namespace) can trivially recover the real value with a standard, built-in
command — no cracking, no special tooling. This is exactly why the lesson's point matters: the
protection here is WHO can read the Secret object at all (RBAC), not the base64 encoding itself.

## Comparing to a ConfigMap

```
$ kubectl get configmap app-config -o yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  environment: production
  log_level: info
```

A ConfigMap's values are stored in PLAIN TEXT — no encoding step at all. This is consistent with
ConfigMaps being explicitly for non-sensitive data; there's no pretense of protection to begin
with.

## Instructor Notes

**Demo script:** Run this live, actually decoding the value in front of the class — the gap
between "Secret" (a name implying protection) and what the command output shows is the entire
point, and it lands far better performed than read.

**Approximate timing:** 6-8 minutes live; 5 minutes self-paced.

**Common misconception to preempt:** this demonstration directly targets the single most common
misconception about Kubernetes Secrets — do not skip it even if time is short, since a wrong
belief here has real security consequences later.

**Optional extension:** ask what a `SealedSecret` or an external secrets manager (mentioned by
name only, not built as a hands-on topic here) is trying to solve that a plain Kubernetes Secret
does not — a good forward pointer without requiring new infrastructure in this course.