Secrets

Secret documentation:

Objects of type secret are intended to hold sensitive information, such as passwords, OAuth tokens, and ssh keys.

Secrets can be mounted into files in the container or used as environment variables.

Secrets are base64 encoded and access control can be enabled so that not all users are able to view the secrets.

Task

Create a secret and mount it into a file in the container at /secrets/supersecret.txt. The endpoint /secret in the sample app can be used to view the secret.

Solution

Solution, Creating the secret from a file

echo -n 'my_supersecret' > ./supersecret.txt
kubectl create secret generic mysecret --from-file=./supersecret.txt

Solution, Mounting the secret into a file in the container

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sample-app-deployment
  labels:
    app: sample-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sample-app
  template:
    metadata:
      labels:
        app: sample-app
    spec:
      containers:
      - name: sample-app
        image: torklo/workshop-frontend
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: greatestconfig
          mountPath: /config/greatestconfig.yml
          readOnly: true
          subPath: greatestconfig.yml
        - name: supersecret
          mountPath: "/secrets"
          readOnly: true
      volumes:
      - name: supersecret
        secret:
          secretName: mysecret
      - name: greatestconfig
        configMap:
          defaultMode: 0600
          name: myconfigmap

Now open a shell in your pod and check if there are any secrets there

kubectl exec -it [pod-name] sh
cat /secrets/*

If the pod won’t start, it may be because two pods tries to mount a PVC that is only supposed to be access by one PVC. You can use kubectl get event to confirm this:

52s         52s          1       workshop-api-deployment-9c4cfc4c6-c5wgx.1599fdece10a7b4f    Pod                                                          Warning   FailedAttachVolume       attachdetach-controller                                      Multi-Attach error for volume "pvc-c3d75a68-6a96-11e9-8cf6-42010aa601e4" Volume is already used by pod(s) workshop-api-deployment-5cf49764b9-75dct

To fix this, delete the deployment and apply it again.


Improve this page