Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to mount multiple files / secrets into common directory in kubernetes?

Tags:

I've multiple secrets created from different files. I'd like to store all of them in common directory /var/secrets/. Unfortunately, I'm unable to do that because kubernetes throws 'Invalid value: "/var/secret": must be unique error during pod validation step. Below is an example of my pod definition.

apiVersion: v1 kind: Pod metadata:   labels:     run: alpine-secret   name: alpine-secret spec:   containers:   - command:     - sleep     - "3600"     image: alpine     name: alpine-secret     volumeMounts:     - name: xfile       mountPath: "/var/secrets/"       readOnly: true     - name: yfile       mountPath: "/var/secrets/"       readOnly: true   volumes:   - name: xfile     secret:       secretName: my-secret-one   - name: yfile     secret:       secretName: my-secret-two 

How can I store files from multiple secrets in the same directory?

like image 898
Lukasz Dynowski Avatar asked Nov 27 '19 22:11

Lukasz Dynowski


People also ask

How are secrets mounted in Kubernetes?

Secrets can be mounted as data volumes or exposed as environment variables to be used by a container in a Pod. Secrets can also be used by other parts of the system, without being directly exposed to the Pod.

Which file system do Secrets use in Kubernetes?

When using definition files, you can add the data in a base64 encoded format or plain text form. Kubernetes encodes the Secret data in base64 format. When you need to reveal a Secret text, you must base64-decode it. To enable containers to access Secrets, you have the option to mount the Secret as a volume.


2 Answers

Projected Volume

You can use a projected volume to have two secrets in the same directory

Example

apiVersion: v1 kind: Pod metadata:   labels:     run: alpine-secret   name: alpine-secret spec:   containers:   - command:     - sleep     - "3600"     image: alpine     name: alpine-secret     volumeMounts:     - name: xyfiles       mountPath: "/var/secrets/"       readOnly: true   volumes:   - name: xyfiles     projected:       sources:       - secret:           name: my-secret-one       - secret:           name: my-secret-two 
like image 190
Jonas Avatar answered Sep 28 '22 01:09

Jonas


(EDIT: Never mind - I just noticed @Jonas gave the same answer earlier. +1 from me)

Starting with Kubernetes v1.11+ it is possible with projected volumes:

A projected volume maps several existing volume sources into the same directory.

Currently, the following types of volume sources can be projected:

  • secret
  • downwardAPI
  • configMap
  • serviceAccountToken

This is an example for "... how to use a projected Volume to mount several existing volume sources into the same directory".

like image 24
apisim Avatar answered Sep 28 '22 02:09

apisim