Symlink Secret in Kubernetes

6/22/2018

I'm trying to use the google sheets and gmail APIs, and I'd like to access the credentials file as a K8s secret (which seem to be mounted as symlinks).

However, the google oauth2 python client specifically says that credential files cannot be symbolic links.

Is there a workaround for this?

-- Garrett R
google-api
kubernetes

1 Answer

6/23/2018

Is there a workaround for this?

There are at least two that I can think of off-hand: environment variables, or an initialization mechanism through which the symlinks are copied to files

Hopefully the first one is straightforward, using env: valueFrom: secretKeyRef: etc.

And for the second approach, I lumped them into "initialization mechanism" because it will depend on your preference between the 3 ways I can immediately think of to do this trick.

Using an initContainer: and a Pod-scoped volume: emptyDir: would enable you to copy the secret to a volume that is shared amongst your containers, and that directory will be cleaned up by kubernetes on the destruction of your Pod

Using an explicit command: to run some shell before launching your actual application:

command:
- bash
- -ec
- |
   cp /path/to/my/secret/* ./my-secret-directory/
   ./bin/launch-my-actual-server

Or, finally (and I would guess you have already considered this), have the application actually read in the contents and then write them back to a file of your choice

-- mdaniel
Source: StackOverflow