Kubernetes for Developers

Exposing Secrets into a container

We can expose Secrets to a Pod in a very similar fashion to exposing ConfigMaps. Like ConfigMaps, you can choose to expose a Secret as an environment variable, or as a file mounted within a volume, specified by the Pod.

The format for exposing a secret looks identical to exposing a ConfigMap value, except that it uses secretKeyRef instead of configMapRef in the specification.

As an example, to expose the preceding example secret password as an environment variable, you might use the following in a Pod specification:

        env:          - name: DB_PASSWORD            valueFrom:              secretKeyRef:                name: database-creds                key: password.txt

Then looking within the container, the environment variables container DB_PASSWORD:

kubectl exec flask-509298146-ql1t9 ...