<p dir="auto">Maybe I'm misunderstanding, or doing something wrong, but I don't think Secrets should be available in clear text by means of <code class="notranslate">kubectl describe secrets</code> even if they are created using <code class="notranslate">kubectl apply -f</code></p>
<h1 dir="auto">Example</h1>
<p dir="auto">my-secret.yaml</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Secret
metadata:
  name: tls
type: Opaque
data:
  tls.crt: BASE64...
  tls.key: BASE64..."><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Secret
metadata:
  name: tls
type: Opaque
data:
  tls.crt: BASE64...
  tls.key: BASE64...
</code></pre></div>
<p dir="auto">Commands:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="kubectl apply -f my-secret.yaml
kubectl describe secrets my-secret"><pre class="notranslate"><code class="notranslate">kubectl apply -f my-secret.yaml
kubectl describe secrets my-secret
</code></pre></div>
<p dir="auto"><code class="notranslate">kubectl describe</code> will have an "Annotations:" field which contains the entire yaml file (as JSON), including my base64 encoded secrets:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Name:       tls
Namespace:  default
Labels:     &lt;none&gt;
Annotations:    kubectl.kubernetes.io/last-applied-configuration={&quot;kind&quot;:&quot;Secret&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{&quot;name&quot;:&quot;tls&quot;,&quot;creationTimestamp&quot;:null},&quot;data&quot;:{&quot;tls.crt&quot;:&quot;BASE64...&quot;,&quot;tls.key&quot;:&quot;BASE64...&quot;},&quot;type&quot;:&quot;Opaque&quot;}

Type:   Opaque

Data
====
tls.key:    1565 bytes
tls.crt:    1234 bytes"><pre class="notranslate"><code class="notranslate">Name:       tls
Namespace:  default
Labels:     &lt;none&gt;
Annotations:    kubectl.kubernetes.io/last-applied-configuration={"kind":"Secret","apiVersion":"v1","metadata":{"name":"tls","creationTimestamp":null},"data":{"tls.crt":"BASE64...","tls.key":"BASE64..."},"type":"Opaque"}

Type:   Opaque

Data
====
tls.key:    1565 bytes
tls.crt:    1234 bytes
</code></pre></div>
<p dir="auto">I appreciate that it's hard to <code class="notranslate">apply</code> something without storing last-applied-configuration, but maybe Secrets should be treated as a special case?</p>
<p dir="auto">when using <code class="notranslate">kubectl apply</code> for secrets the annotation will store the secret data, making it visible to <code class="notranslate">kubectl describe</code></p>