How can you securely manage credentials such as login and password in a Kubernetes cluster?

In Kubernetes, it is recommended to use Secrets — a special object designed for storing confidential data such as logins, passwords, and tokens.

Key points:

• Encryption at the etcd level — Kubernetes can encrypt Secrets in the data store.
• Access control — RBAC can be used to control who can view or modify Secrets.
• Mounting into pods — Secrets can be passed to containers as environment variables or files, avoiding storage in code.
• Using external systems — for higher security, Kubernetes can be integrated with Vault, AWS KMS, and other secret management systems.

Example of creating a Secret with a password:

kubectl create secret generic db-password --from-literal=password=MyS3cretPass

And mounting it into a pod as an environment variable:

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  containers:
  - name: app
    image: myapp
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-password
          key: password

Thus, credentials are not stored in plain text in manifests or container images.