kubectl create secret generic db-secret \

    --from-literal=username=root \

    --from-literal=password=mySecret

In deployment yaml :

env:

- name: DB_USERNAME

  valueFrom:

    secretKeyRef:

      name: db-secret

      key: username

- name: DB_PASSWORD

  valueFrom:

    secretKeyRef:

      name: db-secret

      key: password

In Spring boot :

spring:

  datasource:

    username: ${DB_USERNAME}

    password: ${DB_PASSWORD}

External Secret Manager

  HashiCorp Vault

  AWS Secrets Manager

  Azure Key Vault

  Google Secret Manager

6. Least Privilege

Every service should only access the secrets it needs.

Example

Payment Service

    ↓

Payment DB password only

Order Service

    ↓

Order DB password only

Not Payment Service

    ↓

All company passwords

7. Encrypt Secrets at Rest

Kubernetes Secrets are Base64 encoded by default, which is not encryption.

For production, enable encryption at rest in the Kubernetes API server or use an external KMS provider.

8. CI/CD

Never store secrets in:

· Git

· GitHub repository

· GitLab repository

· Dockerfile

Instead, store them in your CI/CD platform's secure secret store and inject them during deployment.

9. Logging

Never log secrets.

❌ Bad

log.info("Password = {}", password);

Even during debugging.

10. Certificates

Store:

TLS certificates

Private keys

JWT signing keys

as secrets, not inside the application JAR.

                Git

                 │

        (No secrets stored)

                 │

                 ▼

             CI/CD Pipeline

                 │

        Reads Secret Store

                 │

                 ▼

          Kubernetes Secret

                 │

                 ▼

        Spring Boot Pod

                 │

         Environment Variable

                 │

                 ▼

          Spring Configuration

Best Practices Checklist

Practice	Recommended
Hardcode passwords	❌ No
Commit secrets to Git	❌ No
Use environment variables	✅ Yes
Use Kubernetes Secrets	✅ Yes
Use Vault/Key Vault in production	✅ Yes
Rotate secrets regularly	✅ Yes
Enable encryption at rest	✅ Yes
Apply least privilege	✅ Yes
Never log secrets	✅ Yes
Audit secret access	✅ Yes