An app needs both a private registry pull credential and a database…

Question

An app needs both a private registry pull credential and a database password. Which Secret-type guidance is correct?

Accepted Answer

Use a kubernetes.io/dockerconfigjson (docker-registry) Secret for image pulls and an Opaque Secret for the database password. — Different locks for different doors: dockerconfigjson for pulling images, Opaque for the app's DB password. Mixing them into one bootstrap token or a TLS Secret type just muddies the purpose. ConfigMaps still aren't for passwords.

Answer

Store both the registry auth and database password in a single bootstrap.kubernetes.io/token Secret only.

Answer

Put registry pull auth in a ConfigMap and the database password in a ServiceAccount token automatically.

Answer

Use type kubernetes.io/tls for the database password because TLS Secrets accept arbitrary keys.

An app needs both a private registry pull credential and a database password. Which Secret-type guidance is correct?

Short Explanation

Full Explanation