name under which it should be available. Refer to the ConfigMap documentation for more details. Secrets hold Base64-encoded data, and decode it prior passing it to a Pod either as environment variables or mounted volume. This is very often confused as a security feature. Base64 encoding is not an encryption method, and from a security perspec‐ tive, it is considered the same as plain text. Base64 encoding in Secrets allows storing binary data, so why are Secrets considered more secure than ConfigMaps? There are a number of other implementation details of Secrets that make them secure. Constant improvements are occurring in this area, but the main implementation details cur‐ rently are as follows: Regardless of all that, there are still ways to get access to Secrets as a root user, or even by creating a Pod and mounting a Secret. You can apply role-based access control (RBAC) to Secrets (as you can do to ConfigMaps, or other resources), and allow only certain Pods with predefined service accounts to read them. But users who have the ability to create Pods in a namespace can still escalate their privileges within that namespace by creating Pods. They can run a Pod under a greater-privileged service account and still read Secrets. A user or a controller with Pod creation access in a namespace can impersonate any service account and access all Secrets and Config‐ Maps in that namespace. Thus, additional encryption of sensitive information is often done at application level too. Another way to store configuration with the help of Kubernetes is the usage of gitRepo  volumes. This type of volume mounts an empty directory on the Pod and clones a Git repository into it. The advantage of keeping configuration on Git is that you get versioning and auditing for free. But  gitRepo  volumes require external access to a Git repository, which is not a Kubernetes resource, and is possibly located outside the cluster and needs to be monitored and managed separately. The cloning and mounting happens during startup of the Pod, and the local cloned repo is not upda‐ ted automatically with changes. This volume works similarly to the approach described in Chapter 20,  Immutable Configuration  by using  Init Containers  to copy configuration into a shared local volume. In fact, volumes of type  gitRepo  are deprecated now in favor of  Init Container -based solutions, as this approach is more generally applicable and supports other sources of Solution  |  155 • A Secret is distributed only to nodes running Pods that need access to the Secret. • On the nodes, Secrets are stored in memory in a  tmpfs  and never written to physical storage, and removed when the Pod is removed. • In Etcd, Secrets are stored in encrypted form. How Secure Are Secrets?