not load secret in k8s

7/31/2021

I am learning to use k8s and I have a problem. I have been able to perform several deployments with the same yml without problems. My problem is that when I mount the secret volume it loads me the directory with the variables but it does not detect them as environments variable

my secret

apiVersion: v1
kind: Secret
metadata:
  namespace: insertmendoza
  name: authentications-sercret
type: Opaque
data:
  DB_USERNAME: aW5zZXJ0bWVuZG96YQ==
  DB_PASSWORD: aktOUDlaZHRFTE1tNks1

  TOKEN_EXPIRES_IN: ODQ2MDA=
  SECRET_KEY: aXRzaXNzZWd1cmU=

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: insertmendoza
  name: sarys-authentications
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sarys-authentications
  template:
    metadata:
      labels:
        app: sarys-authentications
    spec:
      containers:
        - name: sarys-authentications
          image: 192.168.88.246:32000/custom:image
          imagePullPolicy: Always
          resources:
            limits:
              memory: "500Mi"
              cpu: "50m"
          ports:
            - containerPort: 8000

          envFrom:
            - configMapRef:
                name: authentications-config

          volumeMounts:
            - name: config-volumen
              mountPath: /etc/config/
              readOnly: true

            - name: secret-volumen
              mountPath: /etc/secret/
              readOnly: true

      volumes:
        - name: config-volumen
          configMap:
            name: authentications-config

        - name: secret-volumen
          secret:
            secretName: authentications-sercret

> microservice@1.0.0 start
> node dist/index.js
{
  ENGINE: 'postgres',
  NAME: 'insertmendoza',
  USER: undefined, <-- not load 
  PASSWORD: undefined,<-- not load 
  HOST: 'db-service',
  PORT: '5432'
}

if I add them manually if it recognizes them

 env:
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: authentications-sercret
                  key: DB_USERNAME

            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentications-sercret
                  key: DB_PASSWORD

> microservice@1.0.0 start
> node dist/index.js
{
  ENGINE: 'postgres',
  NAME: 'insertmendoza',
  USER: 'insertmendoza', <-- work 
  PASSWORD: 'jKNP9ZdtELMm6K5', <-- work
  HOST: 'db-service',
  PORT: '5432'
}
listening queue
listening on *:8000

in the directory where I mount the secrets exist!

/etc/secret # ls
DB_PASSWORD       DB_USERNAME       SECRET_KEY        TOKEN_EXPIRES_IN
/etc/secret # cat DB_PASSWORD 
jKNP9ZdtELMm6K5/etc/secret # 
EDIT

My solution speed is

envFrom:
        - configMapRef:
            name: authentications-config

        - secretRef: <<--
            name: authentications-sercret <<--

I hope it serves you, greetings from Argentina Insert Mendoza

-- Nelson Javier Avila
kubernetes
microk8s

1 Answer

7/31/2021

If I understand the problem correctly, you aren't getting the secrets loaded into the environment. It looks like you're loading it incorrectly, use the envFrom form as documented here.

Using your example it would be:

apiVersion: v1
kind: Secret
metadata:
  namespace: insertmendoza
  name: authentications-sercret
type: Opaque
data:
  DB_USERNAME: aW5zZXJ0bWVuZG96YQ==
  DB_PASSWORD: aktOUDlaZHRFTE1tNks1

  TOKEN_EXPIRES_IN: ODQ2MDA=
  SECRET_KEY: aXRzaXNzZWd1cmU=

---

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: insertmendoza
  name: sarys-authentications
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sarys-authentications
  template:
    metadata:
      labels:
        app: sarys-authentications
    spec:
      containers:
        - name: sarys-authentications
          image: 192.168.88.246:32000/custom:image
          imagePullPolicy: Always
          resources:
            limits:
              memory: "500Mi"
              cpu: "50m"
          ports:
            - containerPort: 8000

          envFrom:
            - configMapRef:
                name: authentications-config

            - secretRef:
                name: authentications-sercret

          volumeMounts:
            - name: config-volumen
              mountPath: /etc/config/
              readOnly: true
      volumes:
        - name: config-volumen
          configMap:
            name: authentications-config

Note the volume and mount was removed and just add the secretRef section. Those should now be exported as environment variables in your pod.

-- Joshua Hansen
Source: StackOverflow