Introduction

Kubernetes Secrets are designed to store and manage sensitive information like passwords, OAuth tokens, ssh keys, etc. Kubernetes provides a way to make sensitive data accessible to pods but without exposing this data in your application source code or configuration files.

Injecting a Kubernetes Secret into a configuration file inside a pod can be done in multiple ways. This article outlines the methods and examples for achieving this.

Prerequisites

• Basic knowledge of Kubernetes.
• A functional Kubernetes cluster.
• kubectl command-line tool set up and working with your Kubernetes cluster.
• A Kubernetes Secret already created in your namespace.

Methods for Injecting Kubernetes Secrets

There are multiple methods to inject Kubernetes Secrets into a configuration file in a pod:

1. Using Environment Variables
2. Mounting as a Volume
3. Using Tools within the Pod (e.g., envsubst )

1. Using Environment Variables

Injecting secrets as environment variables is one of the simplest ways. Here’s an example YAML configuration for a pod:

• name: mycontainer
  • name: SECRET_USERNAME
  • name: SECRET_PASSWORD
• name: mycontainer
  • name: secret-volume
• name: secret-volume
• Security: Be cautious when handling secrets. Avoid logging secrets and consider using RBAC to limit access.
• Performance: Using environment variables might be simpler but mounting a secret as a volume is generally preferred for large configurations due to environment size limits.
• Applications: Not all applications can be configured to read secrets from environment variables; in such cases, volume mounting is more appropriate.
• HashiCorp Vault: A tool for secrets management, encryption as a service, and privileged access management.
• Sealed Secrets: Encrypts your secrets into Kubernetes resources that are safe to store publicly.