Managing Secrets in Kubernetes

1 hour
  • 4 Learning Objectives

About this Hands-on Lab

The student is guided to perform the exercises that demonstrate the Kubernetes Secrets resource and how to pass secrets to applications running within pods.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Create and interrogate secrets from the command line with kubectl.

From the Master Node, as cloud_user

Example: Username and Password

First, store the secret data in a file. In this example, we will place a username and password in two files encoded with base64.

echo -n 'admin' > ./username.txt
echo -n 'L1nux@cad3my' > ./password.txt

The kubectl can package these files into a ‘Secret’ object on the API server.

kubectl create secret generic ks-user-pass --from-file=./username.txt --from-file=./password.txt

You can look up secrets with get and describe as follows:

kubectl get secrets
kubectl describe secrets/ks-user-pass

Secrets are masked by default. If you need to obtain the value of a stored secret, you may use the following commands:

kubectl get secret ks-user-pass -o yaml

Then decode the values with:

echo '[stored value here]' | base64 -d
Create Secrets using YAML.

You may also create secrets with a YAML file. The following is an example:

Example YAML:

apiVersion: v1
kind: Secret
metadata:
  name: ks-lab-secret
type: Opaque
data:
  username: "admin"
  password: "L1nux@cad3my"

Additional fields may also be stored in a YAML file.

Use an editor to create ks-secret-config.yaml.

vi ks-secret-config.yaml
apiVersion: v1
kind: Secret
metadata:
  name: ks-secret-config
type: Opaque
stringData:
  config.yaml: |-
    apiUrl: https://ks.api.com/api/v1
    username: admin
    password: L1nux@cad3my
    branchid: branch21

Then create the secret with:

kubectl create -f ks-secret-config.yaml

You may look at the fields by getting the secret in YAML, and then passing the config.yaml field through the decoder.

kubectl get secret ks-secret-config -o yaml
echo '[stored value here]' | base64 -d
Pass Secrets to a pod through a mounted volume.

Secrets may be passed to pods through mounted volumes or through environment variables.

The following is an example as to how volumeMounts specified in a pod’s YAML file may be used:

vi ks-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: ks-pod
  namespace: default
spec:
  containers:
  - name: ks-pod
    image: busybox
    command:
      - sleep
      - "10000"
    volumeMounts:
    - name: ks-path
      mountPath: "/etc/ks-path"
      readOnly: true
  restartPolicy: Never
  volumes:
  - name: ks-path
    secret:
      secretName: ks-secret-config
      items:
      - key: config.yaml
        path: config.yaml
        mode: 400

Then create the pod.

kubectl create -f ks-pod.yaml

After creating the pod, verify it is ready.

kubectl get pods

Once the pod is ready, exec a shell in the pod container.

kubectl exec -it ks-pod -- sh

Once you are inside the busybox container, lets have a look at our secrets.

cd /etc/ks-path
ls -l
cat config.yaml
Pass Secrets to a pod through an environment variable.

Now lets do an example where we can get these secrets through an environment variable.

vi ks-pod-env.yaml
apiVersion: v1
kind: Pod
metadata:
  name: ks-pod-env
spec:
  containers:
  - name: ks-pod-env
    image: busybox
    command:
      - sleep
      - "10000"
    env:
      - name: SECRET_CONFIG
        valueFrom:
          secretKeyRef:
            name: ks-secret-config
            key: config.yaml
  restartPolicy: Never

Now lets create the pod.

kubectl create -f ks-pod-env.yaml

Lets go have a look.

kubectl exec -it ks-pod-env -- sh

And check our variable.

echo $SECRET_CONFIG

Additional Resources

The Instructions below detail all of the commands used in this lab.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Get Started
Who’s going to be learning?

How many seats do you need?

  • $499 USD per seat per year
  • Billed Annually
  • Renews in 12 months

Ready to accelerate learning?

For over 25 licenses, a member of our sales team will walk you through a custom tailored solution for your business.


$2,495.00

Checkout
Sign In
Welcome Back!
Thanks for reaching out!

You’ll hear from us shortly. In the meantime, why not check out what our customers have to say about ACG?