CODEWITHSUNDEEP
kubernetesdeploymentsecret-key
Juan.
Juan.

Reputation: 782

Mount a secret in a Deployment

As the title says, im trying to mount a secret, as a volume, into a deployment.

I found out i can do it in this way if kind: Pod but couldnt replicate it on kind: Deployment

apiVersion: apps/v1
kind: Deployment

volumeMounts:
     - name: certs-vol
       mountPath: "/certs"
       readOnly: true
volumes:
      - name: certs-vol
        secret:
        secretName: certs-secret

the error shows as follows ValidationError(Deployment.spec.template.spec.volumes[1]): unknown field "secretName" in io.k8s.api.core.v1.Volume, ValidationError(Deployment.spec.template.spec.volumes[2]

is there a way to do this, exclusivelly on deployment?

Upvotes: 3

Views: 11563

Answers (1)

Mikołaj Głodziak
Mikołaj Głodziak

Reputation: 5277

As David Maze mentioned in the comment:

Does secretName: need to be indented one step further (a child of secret:)?

Your yaml file should be as follow:

apiVersion: apps/v1
kind: Deployment

volumeMounts:
     - name: certs-vol
       mountPath: "/certs"
       readOnly: true
volumes:
      - name: certs-vol
        secret:
          secretName: certs-secret

You can read more about mounting secret as a file. This could be the most interesing part:

It is possible to create Secret and pass it as a file or multiple files to Pods.
I've created a simple example for you to illustrate how it works. Below you can see a sample Secret manifest file and Deployment that uses this Secret:
NOTE: I used subPath with Secrets and it works as expected.

apiVersion: v1  
kind: Secret  
metadata:  
  name: my-secret  
data:  
  secret.file1: |  
    c2VjcmV0RmlsZTEK  
  secret.file2: |  
    c2VjcmV0RmlsZTIK  

---  

apiVersion: apps/v1  
kind: Deployment  
metadata:  
...  
    spec:  
      containers:  
      - image: nginx  
        name: nginx  
        volumeMounts:  
        - name: secrets-files  
          mountPath: "/mnt/secret.file1"  # "secret.file1" file will be created in "/mnt" directory  
          subPath: secret.file1  
        - name: secrets-files  
          mountPath: "/mnt/secret.file2"  # "secret.file2" file will be created in "/mnt" directory  
          subPath: secret.file2  
      volumes:  
        - name: secrets-files  
          secret:  
            secretName: my-secret # name of the Secret

Note: Secret should be created before Deployment.

Upvotes: 6

Related Questions