Secrets

Passwords, tokens and keys go into a Secret instead of a ConfigMap. A generic Secret is created the same way:

kubectl create secret generic db-pass --from-literal=password=s3cret

Kubernetes answers secret/db-pass created.

Kubernetes is careful with the values. kubectl describe secret db-pass shows only the size of each entry, such as password: 6 bytes, never the value itself.

The stored form is base64 encoded, which you can see with kubectl get secret db-pass -o yaml. Encoding is not encryption: anyone allowed to read the Secret can decode it. The protection comes from controlling who may read Secrets at all.