Loading page
About this tool
Convert a .env file into a Kubernetes Secret manifest with base64-encoded data or plain stringData, validated against k8s naming rules.
This tool converts a .env file into a Kubernetes Secret manifest, base64-encoding each value into the data field (or emitting plain stringData) exactly as kubectl expects. It validates the Secret name against the DNS-1123 subdomain rule and every key against the [-._a-zA-Z0-9]+ pattern the Kubernetes API server enforces, so the generated YAML applies cleanly on the first try.
Open Env to Kubernetes Secret Converter on AltFTool — it loads instantly in your browser.
Paste or upload your source content.
Choose the target format or conversion mode.
Copy or download the converted result.
Values are encoded from their UTF-8 bytes per RFC 4648 — identical output to echo -n value | base64.
Secret names (DNS-1123, max 253 chars) and data keys ([-._a-zA-Z0-9]+) are checked before YAML is produced.
Comments, export prefixes, quoting and multiline values are parsed the way dotenv loaders read them.
Paste the .env, choose a Secret name, and copy the generated manifest — each variable becomes a key under data with its value base64-encoded, in the same shape kubectl create secret generic --from-env-file produces. Apply it with kubectl apply -f secret.yaml and reference it from a pod via envFrom.secretRef.
data holds base64-encoded values, while stringData accepts plain text that the API server encodes into data on write. stringData is write-only convenience — when you read the Secret back you always see base64 in data, and if the same key exists in both fields, stringData wins.
No — base64 is a reversible encoding, decodable by anyone with base64 -d, and offers zero confidentiality. Real protection comes from RBAC on the Secret, encryption at rest for etcd, and keeping manifests with real values out of git (or using sealed-secrets/external-secrets for GitOps).
The Secret's metadata.name must be a DNS-1123 subdomain: lowercase letters, digits, '-' and '.', at most 253 characters, starting and ending alphanumeric. Each data key may contain letters, digits, '-', '_' and '.' — so typical UPPER_SNAKE_CASE env names are valid as-is. The whole Secret is limited to 1 MiB.
Add the Env to Kubernetes Secret Converterwidget to your blog or website — free, responsive, no signup. Just keep the “Widget by AltFTool” credit link visible.
<iframe src="https://www.altftool.com/embed/widget/env-to-kubernetes-secret-converter"
title="Env to Kubernetes Secret Converter — free AltFTool widget"
width="100%" height="640" style="border:0;border-radius:12px;overflow:hidden"
loading="lazy" referrerpolicy="no-referrer-when-downgrade"></iframe>
<p style="font-size:12px;margin:4px 0 0">Widget by <a href="https://www.altftool.com/tools/all/env-to-kubernetes-secret-converter?utm_source=embed&utm_medium=widget">AltFTool — free online tools</a></p>