Distribute Credentials Securely Using Secrets [page]deterministic
This page shows how to securely inject sensitive data, such as passwords and encryption keys, into Pods.
##
### Convert your secret data to a base-64 representation
Suppose you want to have two pieces of secret data: a username `my-app` and a password `39528$vdg7Jb`. First, use a base64 encoding tool to convert your username and password to a base64 representation. Here's an example using the commonly available base64 program:
```shell echo -n 'my-app' | base64 echo -n '39528$vdg7Jb' | base64 ```
The output shows that the base-64 representation of your username is `bXktYXBw`, and the base-64 representation of your password is `Mzk1MjgkdmRnN0pi`.
> Caution: Use a local tool trusted by your OS to decrease the security risks of external tools.
## Create a Secret
Here is a configuration file you can use to create a Secret that holds your username and password:
1. Create the Secret
```shell kubectl apply -f https://k8s.io/examples/pods/inject/secret.yaml ```
1. View information about the Secret:
```shell kubectl get secret test-secret ```
Output:
``` NAME TYPE DATA AGE test-secret Opaque 2 1m ```
1. View more detailed information about the Secret:
```shell kubectl describe secret test-secret ```
Output:
``` Name: test-secret Namespace: default Labels: <none> Annotations: <none>
Type: Opaque
Data ==== password: 13 bytes username: 7 bytes ```
### Create a Secret directly with kubectl
If you want to skip the Base64 encoding step, you can create the same Secret using the `kubectl create secret` command. For example:
```shell kubectl create secret generic test-secret --from-literal='username=my-app' --from-literal='password=39528$vdg7Jb' ```
This is more convenient. The detailed approach shown earlier runs through each step explicitly to demonstrate what is happening.
## Create a Pod that has access to the secret data through a Volume
Here is a configuration file you can use to create a Pod:
1. Create the Pod:
```shell kubectl apply -f https://k8s.io/examples/pods/inject/secret-pod.yaml ```
1. Verify that your Pod is running:
```shell kubectl get pod secret-test-pod ```
Output:
``` NAME READY STATUS RESTARTS AGE secret-test-pod 1/1 Running 0 42m ```
1. Get a shell into the Container that is running in your Pod:
```shell kubectl exec -i -t secret-test-pod -- /bin/bash ```
1. The secret data is exposed to the Container through a Volume mounted under `/etc/secret-volume`.
In your shell, list the files in the `/etc/secret-volume` directory:
```shell # Run this in the shell inside the container ls /etc/secret-volume ```
The output shows two files, one for each piece of secret data:
``` password username ```
1. In your shell, display the contents of the `username` and `password` files:
```shell # Run this in the shell inside the container echo "$( cat /etc/secret-volume/username )" echo "$( cat /etc/secret-volume/password )" ```
The output is your username and password:
``` my-app 39528$vdg7Jb ```
Modify your image or command line so that the program looks for files in the `mountPath` directory. Each key in the Secret `data` map becomes a file name in this directory.
### Project Secret keys to specific file paths
You can also control the paths within the volume where Secret keys are projected. Use the `.spec.volumes[].secret.items` field to change the target path of each key:
```yaml apiVersion: v1 kind: Pod metadata: name: mypod spec: containers: - name: mypod image: redis volumeMounts: - name: foo mountPath: "/etc/foo" readOnly: true volumes: - name: foo secret: secretName: mysecret items: - key: username path: my-group/my-username ```
When you d …(trimmed)