Repository: kubernetes
Issue: Data lost when data is applied as data while not lost if data is applied as stringData in secret
Labels: sig/api-machinery,sig/cli,triage/accepted

If we create secret with data type data and apply new data via secret then its old data is lost and new data is override by it while in case of stringData type data old data is not lost.

We can follow below steps to check it.

1. Create secret with data type values like below:


**# cat data-test-secrets.yaml**
```
apiVersion: v1
kind: Secret
metadata:
  name: data-test-secret
type: Opaque
data:
  testkey: "dGVzdAo="
```
2. Apply test template for creation of data type secret.

**# kubectl apply -f data-test-secrets.yaml**
`secret/data-test-secret created`
#
3. Checking data of secret having key as testkey

**# kubectl get secret -o yaml data-test-secret**
```
apiVersion: v1
data:
  testkey: dGVzdAo=
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"testkey":"dGVzdAo="},"kind":"Secret","metadata":{"annotations":{},"name":"data-test-secret","namespace":"test-system"},"type":"Opaque"}
  creationTimestamp: "2024-03-10T10:22:37Z"
  name: data-test-secret
  namespace: test-system
  resourceVersion: "578963891"
  uid: 1849763a-3296-4fd8-8462-ec411b09a7a3
type: Opaque
```

4. Create secret template with data type new values like below:

**# cat 2data-test-secrets.yaml**
```
apiVersion: v1
kind: Secret
metadata:
  name: data-test-secret
type: Opaque
data:
  newtestkey: "dGVzdAo="
```

5. Apply new test template for update of secret data.
**# kubectl apply -f 2data-test-secrets.yaml**
`secret/data-test-secret configured`
#

6. Checking data of secret having key as testkey ( old key added via old template) removed now and newtestkey ( new key added via new template) added now.

**# kubectl get secret -o yaml data-test-secret**
```
apiVersion: v1
data:
  newtestkey: dGVzdAo=
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"newtestkey":"dGVzdAo="},"kind":"Secret","metadata":{"annotations":{},"name":"data-test-secret","namespace":"test-system"},"type":"Opaque"}
  creationTimestamp: "2024-03-10T10:22:37Z"
  name: data-test-secret
  namespace: test-system
  resourceVersion: "578975054"
  uid: 1849763a-3296-4fd8-8462-ec411b09a7a3
type: Opaque

```

However, if create secret with stringData then old data will not be removed. We can follow below steps to check it.

1. Create secret with string data type values like below:

**# cat stringData-test-secrets.yaml**
```
apiVersion: v1
kind: Secret
metadata:
  name: stringdata-test-secret
type: Opaque
stringData:
  testkey: "test"
```

2. Apply test template for creation of string data type secret.
**# kubectl apply -f stringData-test-secrets.yaml**
`secret/stringdata-test-secret created`
#

3. Checking data of secret having key as testkey

**# kubectl get secret -o yaml stringdata-test-secret**
```
apiVersion: v1
data:
  testkey: dGVzdA==
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"stringdata-test-secret","namespace":"test-system"},"stringData":{"testkey":"test"},"type":"Opaque"}
  creationTimestamp: "2024-03-10T10:38:30Z"
  name: stringdata-test-secret
  namespace: test-system
  resourceVersion: "579000870"
  uid: 31704d46-29a2-425c-8bb0-c06ae13527a1
type: Opaque
```


4. Create secret template with string data type new values like below:

**# cat 2stringData-test-secrets.yaml**
```
apiVersion: v1
kind: Secret
metadata:
  name: stringdata-test-secret
type: Opaque
stringData:
  newtestkey: "test"
```

5. Apply new test template for update of secret data.
**# kubectl apply -f 2stringData-test-secrets.yaml**
`secret/stringdata-test-secret configured`
#

6. Checking data of secret having key as testkey ( old key added via old template) not removed now and newtestkey ( new key added via new template) added now.

**# kubectl get secret -o yaml stringdata-test-secret**
```
apiVersion: v1
data:
  newtestkey: dGVzdA==
  testkey: dGVzdA==
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{},"name":"stringdata-test-secret","namespace":"test-system"},"stringData":{"newtestkey":"test"},"type":"Opaque"}
  creationTimestamp: "2024-03-10T10:38:30Z"
  name: stringdata-test-secret
  namespace: test-system
  resourceVersion: "579006012"
  uid: 31704d46-29a2-425c-8bb0-c06ae13527a1
type: Opaque
```