The command

kubectl create secret generic db-user-pass --from-file=./username.txt --from-file=./password.txt

Works very similarly to creating secrets using manifest files (e.g. yaml or json files). kubectl will create the object using the specified parameters, and you can use the following command to get the raw manifest file:

kubectl get secret -o yaml db-user-pass

Looking on kubectl docs:

      --from-file=[]: Key files can be specified using their file path, in which case a default name will be given to
them, or optionally with a name and file path, in which case the given name will be used.  Specifying a directory will
iterate each named file in the directory that is a valid secret key.

You can do the same with your p12 file and it should just work, maybe the secret name will not be what you want. You can try doing something like:

cat > cert.yaml <<EOF
apiVersion: v1
kind: Secret
metadata:
  labels:
  name: my-certificates
  namespace: nms
type: Opaque
data:
  tls: $(cat ca.p12 | base64 | tr -d '\n')
EOF

Also, notice that you might need a different secret type, so it's best to consult the elastic search docs.

One final note: as you noticed, the secrets are base64 encoded in the manifest files - which makes it really insecure to store them on source control (or anywhere else, actually). There are a few good solutions for creating encrypted secrets that can be persisted to source control, you can read more about it in this post.

Try to create secret like this:

apiVersion: v1
kind: Secret
metadata:
  labels:
  name: my-certificates
  namespace: nms
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm

with proper username and pasword.

Execute command:

$ kubectl apply -f your-secret.yaml

Reboot Node VM.

Then you can decode the password field:

$ echo 'MWYyZDFlMmU2N2Rm' | base64 --decode