20

I have a kubernetes yaml deployment file which accepts db username and password as arguments as shown below. 

args:
        - "-db_host=postgres"
        - "-db_port=5432"
        - "-db_username=postgres"
        - "-db_password=postgres"

To hide the values of db_username and db_password I thought of using kubernetes secret kind. But to achieve that I have to make db_username and db_password as environment variables so that I can use it something like as shown below:

args:
        - "-db_host=postgres"
        - "-db_port=5432"
env:
        - name: db_username
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-user
        - name: db_password
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-pass

Is there any way we can use secret in args itself so that I don't have to do the 2nd approach.

Tinkaal Gogoi
  • 4,344
  • 4
  • 27
  • 36

1 Answers1

41

Once you have an environment variable you can embed its value into the arguments:

env:
- name: MESSAGE
  value: "hello world"
command: ["/bin/echo"]
args: ["$(MESSAGE)"]

Or in your case:

args:
        - "-db_host=postgres"
        - "-db_port=5432"
        - "-db_username=$(db_username)"
        - "-db_password=$(db_password)"
env:
        - name: db_username
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-user
        - name: db_password
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-pass

The reference can be found here

Erez Rabih
  • 15,562
  • 3
  • 47
  • 64
  • 1
    With the emphasize on parenthesis, i.e.: `$(VAR)` instead of accolades, i.e.: `${VAR}` as the latter will return an empty value... – 030 Nov 30 '21 at 21:46
  • never heard them called "accolades" before – Andreas Feb 03 '23 at 13:28
  • @Erez key are visible to user who have login access to pod How can we hide from all? – xyz_scala Feb 27 '23 at 03:10
  • I have the same question as @xyz_scala, I would like to pass the secret without creating an environment variable, mainly to hide it from any other threads or processes that are started. Is it possible to do so? – Arjan Singh Bal Jul 13 '23 at 18:16