From 67aa1fa26aa05c8201b4009f6181e490cbac122b Mon Sep 17 00:00:00 2001 From: Rajesh Deshpande <47311048+rajeshdeshpande02@users.noreply.github.com> Date: Mon, 15 Apr 2019 06:18:00 +0530 Subject: [PATCH] Define container environment variables using Secret data (#13800) * Example for injecting single secret as env variable Define a container environment variable with data from a single Secret * Env variable using secret data * Update pod-single-secret-env-variable.yaml * Adding example for multiple env variable using secrets Adding example for multiple env variables using secrets * Create pod-secret-envFrom.yaml * Update pod-multiple-secret-env-variable.yaml * Update pod-multiple-secret-env-variable.yaml * Update pod-multiple-secret-env-variable.yaml * Update pod-single-secret-env-variable.yaml * Update pod-multiple-secret-env-variable.yaml * Update pod-single-secret-env-variable.yaml * Different ways to add env variable using secret Adding different ways to add env variable in pod using secret * Correcting formatting issues Correcting formatting issues * Correcting format issue --- .../distribute-credentials-secure.md | 112 +++++++++++------- .../pod-multiple-secret-env-variable.yaml | 19 +++ .../pods/inject/pod-secret-envFrom.yaml | 11 ++ .../pod-single-secret-env-variable.yaml | 14 +++ 4 files changed, 115 insertions(+), 41 deletions(-) create mode 100644 content/en/examples/pods/inject/pod-multiple-secret-env-variable.yaml create mode 100644 content/en/examples/pods/inject/pod-secret-envFrom.yaml create mode 100644 content/en/examples/pods/inject/pod-single-secret-env-variable.yaml diff --git a/content/en/docs/tasks/inject-data-application/distribute-credentials-secure.md b/content/en/docs/tasks/inject-data-application/distribute-credentials-secure.md index ff77fab7d7..54d51ec71e 100644 --- a/content/en/docs/tasks/inject-data-application/distribute-credentials-secure.md +++ b/content/en/docs/tasks/inject-data-application/distribute-credentials-secure.md @@ -143,48 +143,78 @@ is exposed: my-app 39528$vdg7Jb ``` - -## Create a Pod that has access to the secret data through environment variables - -Here is a configuration file you can use to create a Pod: - -{{< codenew file="pods/inject/secret-envars-pod.yaml" >}} - -1. Create the Pod: - - ```shell - kubectl apply -f https://k8s.io/examples/pods/inject/secret-envars-pod.yaml - ``` - -1. Verify that your Pod is running: - ```shell - kubectl get pod secret-envars-test-pod - ``` - - Output: - ```shell - NAME READY STATUS RESTARTS AGE - secret-envars-test-pod 1/1 Running 0 4m - ``` - -1. Get a shell into the Container that is running in your Pod: - ```shell - kubectl exec -it secret-envars-test-pod -- /bin/bash - ``` - -1. In your shell, display the environment variables: - ```shell - root@secret-envars-test-pod:/# printenv - ``` - - The output includes your username and password: - ```shell - ... - SECRET_USERNAME=my-app - ... - SECRET_PASSWORD=39528$vdg7Jb - ``` +## Define container environment variables using Secret data + +### Define a container environment variable with data from a single Secret + +* Define an environment variable as a key-value pair in a Secret: + + ```shell + kubectl create secret generic backend-user --from-literal=backend-username='backend-admin' + ``` + +* Assign the `backend-username` value defined in the Secret to the `SECRET_USERNAME` environment variable in the Pod specification. + + {{< codenew file="pods/inject/pod-single-secret-env-variable.yaml" >}} + +* Create the Pod: + + ```shell + kubectl create -f https://k8s.io/examples/pods/inject/pod-single-secret-env-variable.yaml + ``` + +* Now, the Pod’s output includes environment variable `SECRET_USERNAME=backend-admin` + + +### Define container environment variables with data from multiple Secrets + +* As with the previous example, create the Secrets first. + + ```shell + kubectl create secret generic backend-user --from-literal=backend-username='backend-admin' + + kubectl create secret generic db-user --from-literal=db-username='db-admin' + ``` + +* Define the environment variables in the Pod specification. + + {{< codenew file="pods/inject/pod-multiple-secret-env-variable.yaml" >}} + +* Create the Pod: + + ```shell + kubectl create -f https://k8s.io/examples/pods/inject/pod-multiple-secret-env-variable.yaml + ``` + +* Now, the Pod’s output includes `BACKEND_USERNAME=backend-admin` and `DB_USERNAME=db-admin` environment variables. + + +## Configure all key-value pairs in a Secret as container environment variables + +{{< note >}} +This functionality is available in Kubernetes v1.6 and later. +{{< /note >}} + +* Create a Secret containing multiple key-value pairs + + ```shell + kubectl create secret generic test-secret --from-literal=username='my-app' --from-literal=password='39528$vdg7Jb' + ``` + +* Use envFrom to define all of the Secret’s data as container environment variables. The key from the Secret becomes the environment variable name in the Pod. + + {{< codenew file="pods/inject/pod-secret-envFrom.yaml" >}} + +* Create the Pod: + + ```shell + kubectl create -f https://k8s.io/examples/pods/inject/pod-secret-envFrom.yaml + ``` + +* Now, the Pod’s output includes `username=my-app` and `password=39528$vdg7Jb` environment variables. + + {{% /capture %}} {{% capture whatsnext %}} diff --git a/content/en/examples/pods/inject/pod-multiple-secret-env-variable.yaml b/content/en/examples/pods/inject/pod-multiple-secret-env-variable.yaml new file mode 100644 index 0000000000..f285e41932 --- /dev/null +++ b/content/en/examples/pods/inject/pod-multiple-secret-env-variable.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Pod +metadata: + name: envvars-multiple-secrets +spec: + containers: + - name: envars-test-container + image: nginx + env: + - name: BACKEND_USERNAME + valueFrom: + secretKeyRef: + name: backend-user + key: backend-username + - name: DB_USERNAME + valueFrom: + secretKeyRef: + name: db-user + key: db-username diff --git a/content/en/examples/pods/inject/pod-secret-envFrom.yaml b/content/en/examples/pods/inject/pod-secret-envFrom.yaml new file mode 100644 index 0000000000..eb1d3213ef --- /dev/null +++ b/content/en/examples/pods/inject/pod-secret-envFrom.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Pod +metadata: + name: envfrom-secret +spec: + containers: + - name: envars-test-container + image: nginx + envFrom: + - secretRef: + name: test-secret diff --git a/content/en/examples/pods/inject/pod-single-secret-env-variable.yaml b/content/en/examples/pods/inject/pod-single-secret-env-variable.yaml new file mode 100644 index 0000000000..af4cf8732f --- /dev/null +++ b/content/en/examples/pods/inject/pod-single-secret-env-variable.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Pod +metadata: + name: env-single-secret +spec: + containers: + - name: envars-test-container + image: nginx + env: + - name: SECRET_USERNAME + valueFrom: + secretKeyRef: + name: backend-user + key: backend-username