Populate environment variables from OpenShift secret with Docker build strategy

Question

I would like to use on opaque OpenShift secret inside a build pod as environment variable. The secret contains three key-value pairs, so they should become available as three environment variables. (This is for OpenShift 3.9).

I have found a documented example for OpenShift's Source build strategy (sourceStrategy), but need this in the context of a build configuration with Docker build strategy (dockerStrategy). oc explain suggests that extraction of secrets into environment variables should work with both build strategies. So far, so good:

oc explain bc.spec.strategy.sourceStrategy.env.valueFrom.secretKeyRef
oc explain bc.spec.strategy.dockerStrategy.env.valueFrom.secretKeyRef

My build configuration is created from a template, so I have added a section like this as a sibling of dockerStragegy where the template refers to the build configuration:

  env:
  - name: SECRET_1
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: role-1
  - name: SECRET_2
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: role-2
  - name: SECRET_3
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: role-3

The secret was created like this:

oc create secret generic my-secret \
  --from-literal=role-1=... --from-literal=role-2=... --from-literal=role-3=...

After uploading the new template (with oc replace) and recreating the application and hence the build configuration from it (with oc new-app) I observe the following:

• The template contains env as expected (checked with oc get template -o yaml).
• The build configuration does not contain the desired env (checked with oc get bc -o yaml).

What could be the reason why and am I correct in assuming that secrets can be made available inside environment variables for the Docker build strategy. For context: my Dockerfile sets up a relational database (in its ENTRYPOINT script), and needs to configure passwords for three roles, and these should stem from the secret.

Answer 1

This was my mistake: env should reside as a child (not sibling) of dockerStrategy inside the template (as had already been suggested by oc explain's cited path). I've now fixed this, and so the desired parts now show up both in the template and in the build configuration.