Kubernetes cronjob args with env vars

Question

I'm trying to execute a curl command inside a container in gke.

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: app
spec:
  schedule: "* * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: app
            image: appropriate/curl
            env:
            - name: URL
              value: "https://app.com"
            - name: PASSWORD
              value: "pass"
            args: ["-vk", "-H", "\"Authorization: Bearer $(PASSWORD)\"", "$(URL)"]
          restartPolicy: OnFailure

Error:

curl: option -vk -H "Authorization: Bearer pass" https://app.com: is unknown

I just can't find out how to execute the curl with the args field using environment variables.

This curl command works in my pc.
What am I doing wrong?
How can I integrate env vars with container curl command args?

Answer 1

You don't need to wrap the auth header in quotes, kubernetes will do that for you.

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: app
spec:
  schedule: "* * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: app
            image: appropriate/curl
            env:
            - name: URL
              value: "app.com"
            - name: PASSWORD
              value: "pass"
            args: ["-vk", "-H", "Authorization: Bearer $(PASSWORD)", "$(URL)"]
          restartPolicy: OnFailure

You can test the output yaml by doing:

kubectl apply -f job.yaml -o yaml --dry-run

which shows the final output is fine

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"batch/v1beta1","kind":"CronJob","metadata":{"annotations":{},"name":"app","namespace":"default"},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"args":["-vk","-H","Authorization: Bearer $(PASSWORD)","$(URL)"],"env":[{"name":"URL","value":"https://app.com"},{"name":"PASSWORD","value":"pass"}],"image":"appropriate/curl","name":"app"}],"restartPolicy":"OnFailure"}}}},"schedule":"* * * * *"}}
  name: app
  namespace: default
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - args:
            - -vk
            - -H
            - 'Authorization: Bearer $(PASSWORD)'
            - $(URL)
            env:
            - name: URL
              value: https://app.com
            - name: PASSWORD
              value: pass
            image: appropriate/curl
            name: app
          restartPolicy: OnFailure

I tested this with https://requestbin.fullcontact.com/ and the bearer token was passed without issue