Skip to main content

Managing Secrets in Kubernetes

Hands-On Lab

 

Photo of John Marx

John Marx

Training Architect

Length

01:00:00

Difficulty

Beginner

The student is guided to perform the exercises that demonstrate the Kubernetes Secrets resource and how to pass secrets to applications running within pods.

What are Hands-On Labs?

Hands-On Labs are scenario-based learning environments where learners can practice without consequences. Don't compromise a system or waste money on expensive downloads. Practice real-world skills without the real-world risk, no assembly required.

Managing Secrets in Kubernetes

Introduction

The student is guided to perform the exercises that demonstrate the Kubernetes Secrets resource and how to pass secrets to applications running within pods.

Solution

Start by logging in to the Kube Master node using the credentials provided on the hands-on lab page.

ssh cloud_user@KUBE_MASTER_PUBLIC_IP

Create and interrogate secrets from the command line with kubectl

From the Master Node, as cloud_user

Example: Username and Password

  1. First, store the secret data in a file. In this example, we will place a username and password in two files encoded with base64.

    echo -n 'admin' > ./username.txt
    echo -n 'L1nux@cad3my' > ./password.txt
  2. The kubectl can package these files into a 'Secret' object on the API server.

    kubectl create secret generic ks-user-pass --from-file=./username.txt --from-file=./password.txt
  3. You can look up secrets with get and describe as follows:

    kubectl get secrets
    kubectl describe secrets/ks-user-pass
  4. Secrets are masked by default. If you need to obtain the value of a stored secret, you may use the following commands:

    kubectl get secret ks-user-pass -o yaml
  5. Then decode the values with:

    echo '[stored value here]' | base64 -d

Create Secrets using YAML

You may also create secrets with a YAML file. The following is an example:

Example YAML:

apiVersion: v1
kind: Secret
metadata:
  name: ks-lab-secret
type: Opaque
data:
  username: "admin"
  password: "L1nux@cad3my"

Additional fields may also be stored in a YAML file.

  1. Use an editor to create ks-secret-config.yaml.

    vi ks-secret-config.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: ks-secret-config
    type: Opaque
    stringData:
      config.yaml: |-
        apiUrl: https://ks.api.com/api/v1
        username: admin
        password: L1nux@cad3my
        branchid: branch21
  2. Then create the secret with:

    kubectl create -f ks-secret-config.yaml
  3. You may look at the fields by getting the secret in YAML, and then passing the config.yaml field through the decoder.

    kubectl get secret ks-secret-config -o yaml
    echo '[stored value here]' | base64 -d

Pass Secrets to a pod through a mounted volume

Secrets may be passed to pods through mounted volumes or through environment variables.

  1. The following is an example as to how volumeMounts specified in a pod's YAML file may be used:

    vi ks-pod.yaml
    apiVersion: v1
    kind: Pod
    metadata:
      name: ks-pod
      namespace: default
    spec:
      containers:
      - name: ks-pod
        image: busybox
        command:
          - sleep
          - "10000"
        volumeMounts:
        - name: ks-path
          mountPath: "/etc/ks-path"
          readOnly: true
      restartPolicy: Never
      volumes:
      - name: ks-path
        secret:
          secretName: ks-secret-config
          items:
          - key: config.yaml
            path: config.yaml
            mode: 400
  2. Then create the pod.

    kubectl create -f ks-pod.yaml
  3. After creating the pod, verify it is ready.

    kubectl get pods
  4. Once the pod is ready, exec a shell in the pod container.

    kubectl exec -it ks-pod -- sh
  5. Once you are inside the busybox container, lets have a look at our secrets.

    cd /etc/ks-path
    ls -l
    cat config.yaml

Pass Secrets to a pod through an environment variable

  1. Now lets do an example where we can get these secrets through an environment variable.

    vi ks-pod-env.yaml
    apiVersion: v1
    kind: Pod
    metadata:
      name: ks-pod-env
    spec:
      containers:
      - name: ks-pod-env
        image: busybox
        command:
          - sleep
          - "10000"
        env:
          - name: SECRET_CONFIG
            valueFrom:
              secretKeyRef:
                name: ks-secret-config
                key: config.yaml
      restartPolicy: Never
  2. Now lets create the pod.

    kubectl create -f ks-pod-env.yaml
  3. Lets go have a look.

    kubectl exec -it ks-pod-env -- sh
  4. And check our variable.

    echo $SECRET_CONFIG

Conclusion

Congratulations, you've completed this hands-on lab!