Kubernetes exposes more environment variables than expected

3/18/2020

I've faced a strange behaviour with K8s pods running in AWS EKS cluster (version 1.14). The services are deployed via Helm 3 charts. The case is that pod receives more environment variables than expected.

The pod specification says that variables should be populated from a config map.

apiVersion: v1
kind: Pod
metadata:
  name: apigw-api-gateway-59cf5bfdc9-s6hrh
  namespace: development
spec:
  containers:
  - env:
    - name: JAVA_OPTS
      value: -server -XX:MaxRAMPercentage=75.0 -XX:+UseContainerSupport -XX:+HeapDumpOnOutOfMemoryError
    - name: GATEWAY__REDIS__HOST
      value: apigw-redis-master.development.svc.cluster.local
    envFrom:
    - configMapRef:
        name: apigw-api-gateway-env # <-- this is the map
  # the rest of spec is hidden

The config map apigw-api-gateway-env has this specification:

apiVersion: v1
data:
  GATEWAY__APP__ADMIN_LOPUSH: ""
  GATEWAY__APP__CUSTOMER_LOPUSH: ""
  GATEWAY__APP__DISABLE_RATE_LIMITS: "true"
  # here are other 'GATEWAY__' envs
  JMX_AUTH: "false"
  JMX_ENABLED: "true"
  # here are other 'JMX_' envs
kind: ConfigMap
metadata:
  name: apigw-api-gateway-env
  namespace: development

If I request a list of environment variables, I can find values from a different service. These values are not specified in the config map of the 'apigw' application; they are stored in a map for a 'lopush' application. Here is a sample.

/ # env | grep -i lopush | sort | head -n 4 
GATEWAY__APP__ADMIN_LOPUSH=<hidden>
GATEWAY__APP__CUSTOMER_LOPUSH=<hidden>
LOPUSH_GAME_ADMIN_MOBILE_PORT=tcp://172.20.248.152:5050
LOPUSH_GAME_ADMIN_MOBILE_PORT_5050_TCP=tcp://172.20.248.152:5050

I've also noticed that this behaviour is somehow relative to the order in which the services were launched. That could be just because some config maps didn't exist at that moment. It seems for now like the pod receives variables from all config maps in the current namespace.

Did any one faced this issue before? Is it possible, that there are other criteria which force K8s to populate environment from other maps?

-- sviklim
aws-eks
configmap
kubernetes

1 Answer

3/18/2020

If you mean the _PORT stuff, that's for compatibility with the old Docker Container Links system. All services in the namespace get automatically set up that way to make it easier to move things from older Docker-based systems.

-- coderanger
Source: StackOverflow