{"id":20596,"date":"2021-03-24T09:31:01","date_gmt":"2021-03-24T09:31:01","guid":{"rendered":"http:\/\/www.devopsschool.com\/blog\/?p=20596"},"modified":"2025-01-23T12:45:32","modified_gmt":"2025-01-23T12:45:32","slug":"explained-kubernetes-secret-with-example","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/explained-kubernetes-secret-with-example\/","title":{"rendered":"Explained Kubernetes Secret with Example"},"content":{"rendered":"\n

What is Kubernetes Secrets<\/strong>
A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. Objects of type secret are intended to hold sensitive information, such as passwords, OAuth tokens, and ssh keys. Putting this information in a secret is safer and more flexible than putting it verbatim in a pod definition or in a docker image. putting it in a Secret object allows for more control over how it is used, and reduces the risk of accidental exposure.<\/p>\n\n\n\n

How Secrets can be created?<\/strong>
Built-in Secrets – The system also creates some secrets. Service Accounts Automatically Create and Attach Secrets with API Credentials. Kubernetes automatically creates secrets which contain credentials for accessing the API and it automatically modifies your pods to use this type of secret.<\/p>\n\n\n\n

  1. Creating your own Secrets – Users can create secrets. Creating a Secret Using kubectl create secret.<\/li><\/ol>\n\n\n\n

    How to Create Secrets?<\/strong>
    Method 1 – Creating a Secret Using “kubectl create secret”<\/strong>
    Assume – Say that some pods need to access a database. The username and password that the pods should use is in the files .\/username.txt and .\/password.txt on your local machine.<\/p>\n\n\n

    echo<\/span>  'admin'<\/span> | base64\necho<\/span>  'password'<\/span> | base64<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
    apiVersion: v1\nkind: Secret\nmetadata:\n  name: mysecret\ntype: Opaque\ndata:\n  username: YWRtaW4K\n  password: cGFzc3dvcmQK<\/code><\/span><\/pre>\n\n\n
    \n\n\n
    apiVersion: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: mysecretpod\nspec<\/span>:\n  containers:\n  - name: mypod\n    image<\/span>: scmgalaxy\/nginx-devopsschoolv1\n    volumeMounts<\/span>:\n    - name: foo\n      mountPath<\/span>: \"\/etc\/foo\"<\/span>\n      readOnly<\/span>: true<\/span>\n  volumes<\/span>:\n  - name: foo\n    secret<\/span>:\n      secretName: mysecret<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
     1069<\/span>  vi secret.yaml\n 1070<\/span>  kubectl get<\/span> secret\n 1071  kubectl create -f secret.yaml\n 1072  kubectl get<\/span> secret\n 1073  clear\n 1074  ls\n 1075  vi mysecretpod.yaml\n 1076  kubectl create -f mysecretpod.yaml\n 1077  kubectl get<\/span> pods\n 1078  kubectl exec mysecretpod ls \/etc\/foo\n 1079  kubectl exec mysecretpod ls \/etc\/foo\/username\n 1080  kubectl exec mysecretpod more \/etc\/foo\/username\n 1081  kubectl exec mysecretpod more \/etc\/foo\/password\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
    # wordpress-secrets.yml<\/span>\napiVersion: v1\nkind: Secret\nmetadata:\n  name: wordpress-secrets\ntype: Opaque\ndata:\n  db-password: cGFzc3dvcmQ=\n\n# wordpress-service.yml<\/span>\napiVersion: v1\nkind: Service\nmetadata:\n  name: wordpress-service\nspec:\n  ports:\n  - port: 31001<\/span>\n    nodePort: 31001<\/span>\n    targetPort: http-port\n    protocol: TCP\n  selector:\n    app: wordpress\n  type: NodePort\n\n# wordpress-single-deployment-no-volumes.yml<\/span>\napiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: wordpress-deployment\nspec:\n  replicas: 1<\/span>\n  template:\n    metadata:\n      labels:\n        app: wordpress\n    spec:\n      containers:\n      - name: wordpress\n        image: wordpress:4<\/span>-php7.0<\/span>\n        ports:\n        - name: http-port\n          containerPort: 80<\/span>\n        env:\n          - name: WORDPRESS_DB_PASSWORD\n            valueFrom:\n              secretKeyRef:\n                name: wordpress-secrets\n                key: db-password\n          - name: WORDPRESS_DB_HOST\n            value: 127.0<\/span>.0<\/span>.1<\/span>\n      - name: mysql\n        image: mysql:5.7<\/span>\n        ports:\n        - name: mysql-port\n          containerPort: 3306<\/span>\n        env:\n          - name: MYSQL_ROOT_PASSWORD\n            valueFrom:\n              secretKeyRef:\n                name: wordpress-secrets\n                key: db-password<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
    Each item must be base64 encoded:\n$ echo<\/span> -n 'admin'<\/span> | base64\nYWRtaW4=\n$ echo<\/span> -n '1f2d1e2e67df'<\/span> | base64\nMWYyZDFlMmU2N2Rm\n\nNow write a secret object in yaml file \"secret.yaml\"<\/span> that looks like this:\napiVersion: v1\nkind: Secret\nmetadata:\n  name: mysecret\ntype: Opaque\ndata:\n  username: YWRtaW4=\n  password: MWYyZDFlMmU2N2Rm\n\napiVersion: v1\nkind: Secret\nmetadata:\n  name: db-secrets\ntype: Opaque\ndata:\n  username: cm9vdA==\n  password: cGFzc3dvcmQ=\n\n\n$ kubectl create -f .\/secret.yaml\n\nHow to Decoding a Secret\n$ kubectl get secret mysecret -o yaml\n$ $ echo<\/span> 'MWYyZDFlMmU2N2Rm'<\/span> | base64 --decode<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
    apiVersion: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: mypod\nspec<\/span>:\n  containers:\n  - name: mypod\n    image<\/span>: redis\n    volumeMounts<\/span>:\n    - name: foo\n      mountPath<\/span>: \"\/etc\/foo\"<\/span>\n      readOnly<\/span>: true<\/span>\n  volumes<\/span>:\n  - name: foo\n    secret<\/span>:\n      secretName: mysecret\n\n\napiVersion<\/span>: extensions\/v1beta1\nkind<\/span>: Deployment\nmetadata<\/span>:\n  name: helloworld-deployment\nspec<\/span>:\n  replicas: 3<\/span>\n  template<\/span>:\n    metadata:\n      labels:\n        app: helloworld\n    spec<\/span>:\n      containers:\n      - name: k8s-demo\n        image<\/span>: wardviaene\/k8s-demo\n        ports<\/span>:\n        - name: nodejs-port\n          containerPort<\/span>: 3000<\/span>\n        volumeMounts<\/span>:\n        - name: cred-volume\n          mountPath<\/span>: \/etc\/<\/span>creds\n          readOnly<\/span>: true<\/span>\n      volumes<\/span>:\n      - name: cred-volume\n        secret<\/span>: \n          secretName: db-secrets\n\n$ kubectl create -f helloworld-secrets-volumes.yaml\n$ kubectl gets pods\n$ kubectl describe pod podname\n$ kubectl exec podname -i -t -- \/bin\/<\/span>bash\n$ cd \/etc\/creds\n\n\nProjection of<\/span> secret keys to specific paths\n\napiVersion<\/span>: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: mypod\nspec<\/span>:\n  containers:\n  - name: mypod\n    image<\/span>: redis\n    volumeMounts<\/span>:\n    - name: foo\n      mountPath<\/span>: \"\/etc\/foo\"<\/span>\n      readOnly<\/span>: true<\/span>\n  volumes<\/span>:\n  - name: foo\n    secret<\/span>:\n      secretName: mysecret\n      items<\/span>:\n      - key: username\n        path<\/span>: my-group\/my-username<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n
    $ kubectl exec podname -i -t -- \/bin\/<\/span>bash\n$ ls \/etc\/foo\/\nusername\npassword\n$ cat \/etc\/foo\/username\nadmin\n$ cat \/etc\/foo\/password\n1<\/span>f2d1e2e67df\n\nUsing Secrets as<\/span> Environment Variables\t\nThis is an example of<\/span> a pod that uses secrets from<\/span> environment variables:\n\napiVersion: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: secret-env-pod\nspec<\/span>:\n  containers:\n  - name: mycontainer\n    image<\/span>: redis\n    env<\/span>:\n      - name: SECRET_USERNAME\n        valueFrom<\/span>:\n          secretKeyRef:\n            name: mysecret\n            key<\/span>: username\n      - name: SECRET_PASSWORD\n        valueFrom<\/span>:\n          secretKeyRef:\n            name: mysecret\n            key<\/span>: password\n  restartPolicy<\/span>: Never\n\nConsuming Secret Values from<\/span> Environment Variables\n$ kubectl exec podname -i -t -- \/bin\/<\/span>bash\n$ echo $SECRET_USERNAME\nadmin\n$ echo $SECRET_PASSWORD\n1<\/span>f2d1e2e67df\n\nWordPress Demo\n=============================\nwordpress-secrets.yml\napiVersion<\/span>: v1\nkind<\/span>: Secret\nmetadata<\/span>:\n  name: wordpress-secrets\ntype<\/span>: Opaque\ndata<\/span>:\n  db-password: cGFzc3dvcmQ=\n\nwordpress-single-deployment-no-volumes.yml\napiVersion<\/span>: extensions\/v1beta1\nkind<\/span>: Deployment\nmetadata<\/span>:\n  name: wordpress-deployment\nspec<\/span>:\n  replicas: 1<\/span>\n  template<\/span>:\n    metadata:\n      labels:\n        app: wordpress\n    spec<\/span>:\n      containers:\n      - name: wordpress\n        image<\/span>: wordpress:4<\/span>-php7.0<\/span>\n        ports<\/span>:\n        - name: http-port\n          containerPort<\/span>: 80<\/span>\n        env<\/span>:\n          - name: WORDPRESS_DB_PASSWORD\n            valueFrom<\/span>:\n              secretKeyRef:\n                name: wordpress-secrets\n                key<\/span>: db-password\n          - name: WORDPRESS_DB_HOST\n            value<\/span>: 127.0<\/span>.0<\/span>.1<\/span>\n      - name: mysql\n        image<\/span>: mysql:5.7<\/span>\n        ports<\/span>:\n        - name: mysql-port\n          containerPort<\/span>: 3306<\/span>\n        env<\/span>:\n          - name: MYSQL_ROOT_PASSWORD\n            valueFrom<\/span>:\n              secretKeyRef:\n                name: wordpress-secrets\n                key<\/span>: db-password\n\nwordpress-service.yml\napiVersion<\/span>: v1\nkind<\/span>: Service\nmetadata<\/span>:\n  name: wordpress-service\nspec<\/span>:\n  ports:\n  - port: 31001<\/span>\n    nodePort<\/span>: 31001<\/span>\n    targetPort<\/span>: http-port\n    protocol<\/span>: TCP\n  selector<\/span>:\n    app: wordpress\n  type<\/span>: NodePort\n\n\nreference\nhttps<\/span>:\/\/kubernetes.io\/docs\/concepts\/configuration\/secret\/<\/span>\n\n\napiVersion: v1\nkind<\/span>: Pod\nmetadata<\/span>:\n  name: mypod\nspec<\/span>:\n  containers:\n  - name: mypod\n    image<\/span>: ngnix\n    volumeMounts<\/span>:\n    - name: foo\n      mountPath<\/span>: \"\/etc\/foo\"<\/span>\n      readOnly<\/span>: true<\/span>\n  volumes<\/span>:\n  - name: foo\n    secret<\/span>:\n      secretName: db-user-pass<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n