Check whether a Kubernetes Secret's encoded data fits within size constraints.
Kubernetes Secrets store their data values base64-encoded, which inflates raw byte size by roughly 4/3 (33% overhead) before it's persisted to etcd. Combined with etcd's hard 1MiB object size limit, a Secret holding what looks like a modest 800KB of raw certificate/key data can actually fail to create once encoding overhead is accounted for — this calculator applies that encoding factor to give an accurate size check.
encodedSize = rawSize × (4 / 3)
Secret values can contain arbitrary binary data (certs, keys) that isn't safe to embed directly in YAML/JSON; base64 encoding makes it representable as printable text in the API object, at the cost of the well-known ~33% size overhead of that encoding scheme.
No — base64 is a reversible text encoding, not encryption. Anyone with API access to read the Secret object can trivially decode it; actual confidentiality relies on RBAC restricting who can read Secrets, plus optionally encryption-at-rest for etcd.
Split data across multiple Secret objects, or store large sensitive blobs in an external secrets manager (e.g. Vault, cloud KMS-backed secret store) and inject only a reference or short-lived credential via the Secret instead of the full payload.