Repository navigation
Launchers - Kubernetes - Implement hiding of secrets #104
Description
Secret arguments should be turned into Kubernetes Secret resources.
(Kubernetes secrets are multi-key dictionaries. Should we use per-user or per-Secret objects?)
Secret in env consumed using inputValue:
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: some-user
key: usernameSecret in command-line consumed using inputValue:
Use secret environment variable and Kubernetes env variable substitution
https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#use-environment-variables-to-define-arguments
kubernetes/kubernetes#101137 (comment)
$(SECRET_ENV_NAME)
Secret consumed using inputPath:
spec:
containers:
- name: mypod
image: redis
volumeMounts:
- name: foo
mountPath: "/etc/foo"
readOnly: true
volumes:
- name: foo
secret:
secretName: mysecret
items:
- key: username
path: secrets/my-usernameMetadata
Metadata
Assignees
Labels
No labels
Activity