Secret (K8s)
A Kubernetes object for sensitive configuration — passwords, API keys, certificates. It works like a ConfigMap but is intended for secrets and treated slightly more securely. Notorious for only base64-encoding (not encrypting) by default.
Mechanic: like ConfigMaps, Secrets are injected as environment variables or mounted files. Important misconception: base64 is NOT encryption — anyone with read access can decode a Secret trivially. Actual protection requires: encryption at rest in etcd (must be enabled explicitly), RBAC that restricts who can read Secrets, and preferably an external secrets manager (HashiCorp Vault, AWS Secrets Manager) via the Secrets Store CSI driver, or Sealed Secrets/External Secrets for GitOps (so you don't check plaintext secrets into git). Handling Secrets correctly is one of the most common security gaps in Kubernetes. Distinct from a ConfigMap through the intent + the extra layers of protection you should add. Related to ConfigMap and secret rotation.