Mounting a Secret

Learn to mount a Secret as environment or volume.

Using Secrets

Secrets are given to a container in the same ways as a ConfigMap: as environment variables with secretKeyRef/secretRef, or as files in a volume. Mounting as files is safer: environment variables can show up in crash dumps and child processes.

          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-gizli
                  key: DB_PASSWORD
          volumeMounts:
            - name: tls
              mountPath: /etc/tls
              readOnly: true
      volumes:
        - name: tls
          secret:
            secretName: web-tls

File permissions

The permissions of the files in a Secret volume can be restricted with defaultMode (an octal value). That way only the file owner can read them:

      volumes:
        - name: tls
          secret:
            secretName: web-tls
            defaultMode: 0400

$ kubectl exec web -- ls -l /etc/tls/
-r-------- 1 root root  ... tls.crt
-r-------- 1 root root  ... tls.key

Exercise Provide the password

Write a container section (starting with containers:): container named api, image api:1.0; under env, the DB_PASSWORD variable from the DB_PASSWORD key of the db-gizli Secret with secretKeyRef.

Show example solution

containers:
  - name: api
    image: api:1.0
    env:
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef:
            name: db-gizli
            key: DB_PASSWORD

Test yourself

Which field gives the Secret's name in a volume?
- name
- secretRef
- key
- secretName
Show answer

secretName — A ConfigMap volume uses name, a Secret volume uses secretName.

Take a single key from a Secret into an environment variable.

              valueFrom:
                ____:
                  name: db-gizli
                  key: DB_PASSWORD

Show answer

              valueFrom:
                secretKeyRef:
                  name: db-gizli
                  key: DB_PASSWORD

Match.

secretKeyRef

Single-key env var
secretRef

All keys (envFrom)
secretName

Volume source
defaultMode

File permission

Next lesson: kubectl create secret

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies