Kubernetes security fundamentals: Secrets

This post reviews Kubernetes secrets management: threat models for secrets (at rest, in transit, and API attacks), how Kubernetes Secret objects are stored and consumed (env vars vs mounted files), differences between Secrets and ConfigMaps, considerations for managed vs unmanaged clusters (including encryption at rest), dangers on worker nodes and with hostPath mounts, RBAC/list-and-watch implications, and trade-offs of using external secret stores versus native Secrets.