I am new to Kubernetes (aren't we all?).
Can a Secret, consisting of course of keys and values, be represented as a single file when used by a container?
I understand that normally a Secret, when mounted by a container, is essentially a directory. I was wondering if there was some syntactic sugar or other construct that I'm missing that could represent it as, say, a Java Properties
file, whose keys would be the secret's keys, and whose values would be the secret's values.
For others visiting, this now possible using the stringData
field of a Secret
definition.
So for this example, I have a secret called environment-secrets
. This secret contains a single key called env.yml
, which is itself a YAML file containing a number of key=value
parings. I want to mount this secret onto my pods at /credentials/env/env.yml
.
Firstly I define the object definition for the secret as follows in a file called environment-secret.yml
:
- kind: Secret
apiVersion: v1
metadata:
name: environment-secret
type: Opaque
stringData:
env.yml: |-
db_host=my-db.host
db_user=db-user
db_password=db-pass
I then create the secret using kubectl create -f environment-secret.yml
. Upon creation, the values in the env.yml
stringData
field are converted into a env.yml
entry in the data
field of the secret.
Next I update my PodSpec
to mount the secret at my desired location. So I firstly define the secret as a volume:
volumes:
- name: environment-secret
secret:
optional: false
secretName: environment-secret
And then update the mountPoints
to mount this secret at my preferred location within my containers:
volumeMounts:
- mountPath: /credentials/env
name: environment-secret
After this I have a file on my container at /credentials/env/env.yml
that contains my key=value
pairings.
This is not possible currently. The only way to get around this is to have a key value pair where the value is a base64 encoded JSON object.
apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
conf.json: eyJrZXkiOiAidmFsdWUiLCAia2V5MiI6ICJ2YWx1ZTIifQ==
The conf.json
value is just:
echo -n '{"key": "value", "key2": "value2"}' | base64