Kubernetes can’t make that substitution for you, you should do it with shell in the entrypoint of the container. This is a working example. I modify the default entrypoint to create a new variable with that substitution. After this command you should add the desired entrypoint. apiVersion: extensions/v1beta1 kind: Deployment metadata: name: app labels: app: … Read more
You can write that yaml by yourself, but it will be faster to create it in 2 steps using kubectl: Generate a ‘yaml’ file. You can use the same command but in dry-run mode and output mode yaml. Here is an example of a command that will save a secret into a ‘docker-secret.yaml’ file for … Read more
Projected Volume You can use a projected volume to have two secrets in the same directory Example apiVersion: v1 kind: Pod metadata: labels: run: alpine-secret name: alpine-secret spec: containers: – command: – sleep – “3600” image: alpine name: alpine-secret volumeMounts: – name: xyfiles mountPath: “/var/secrets/” readOnly: true volumes: – name: xyfiles projected: sources: – secret: … Read more
As answered on previous post, we need to provide the certificate/key encoded as based64 to the file. Here is generic example for a certiticate (in this case SSL): The secret.yml.tmpl: apiVersion: v1 kind: Secret metadata: name: test-secret namespace: default type: Opaque data: server.crt: SERVER_CRT server.key: SERVER_KEY Pre-process the file to include the certificate/key: sed “s/SERVER_CRT/`cat … Read more
I got the decoded values “mega_secret_key” and “really_secret_value1” from from your encoded data. Seems they are not encoded in right way. So, encode your data in right way: $ echo “mega_secret_key” | base64 bWVnYV9zZWNyZXRfa2V5Cg== $ echo “really_secret_value1” | base64 cmVhbGx5X3NlY3JldF92YWx1ZTEK Then check whether they are encoded properly: $ echo “bWVnYV9zZWNyZXRfa2V5Cg==” | base64 -d mega_secret_key $ … Read more
The most direct (and interactive) way should be to execute kubectl edit secret <my secret>. Run kubectl get secrets if you’d like to see the list of secrets managed by Kubernetes.
This should work: kubectl create secret generic production-tls \ –save-config \ –dry-run=client \ –from-file=./tls.key –from-file=./tls.crt \ -o yaml | \ kubectl apply -f –