How to use GitHub Actions secrets in k8s Job env?

Question

I want to deploy a k8s job in k8s cluster with GitHub Actions. But there are some env variables in job.yaml:

apiVersion: batch/v1
kind: Job
metadata:
  name: pi01
spec:
  template:
    spec:
      containers:
      - name: pi01
        image: xx:version
        command: ["node", "schedule/schedule.js"]
        env:
          - name: DB_HOST
            value: {{ ${{ secrets.DB_HOST }} }}
          - name: DB_PORT
            value: {{ ${{ secrets.DB_PORT }} }}
          - name: DB_USER
            value: {{ ${{ secrets.DB_USER }} }}
          - name: DB_PASSWORD
            value: {{ ${{ secrets.DB_PASSWORD }} }}

because those env variables are sensitive, I save them as secrets.

In GitHub Actions workflow, I don't know how to put secrets into env variables of job.yaml.

With this command, I don't know which option I should use:

kubectl apply -f job.yaml [Options]

Could you please provide an example for me to refer?

In workflow, I used this script but I don't know how to input ${{ secrets.DB_PASSWORD }} into YAML file:

- name: Deploy app to AKS
  run: |
    kubectl apply -f job.yaml

Relevant: https://stackoverflow.com/questions/75675348/how-can-i-use-github-secrets-in-a-npmrc-file — Azeem, May 16 '23 at 17:07

score 0 · Accepted Answer · answered May 16 '23 at 12:28

It won't work like that you have to Go with placeholder option, add one step into your Github Action

Job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: pi01
spec:
  template:
    spec:
      containers:
      - name: pi01
        image: xx:version
        command: ["node", "schedule/schedule.js"]
        env:
          - name: DB_HOST
            value: VAL_DB_HOST
          - name: DB_PORT
            value: VAL_DB_PORT

Run command

sed -i "s,VAL_DB_HOST,$secrets.DB_HOST," job.yaml
sed -i "s,VAL_DB_PORT,$secrets.DB_PORT," job.yaml

You can write shell script or further optimize it as per need. Above command will replace VAL_DB_HOST in Job.yaml with environment variable value saved.

Once your file job.yaml is ready, apply the changes

kubectl apply -f job.yaml

You can use the different method, Helm, Skafold also for templating if you are looking for that else above will be simple method.

it works, thanks for your professional answers. – ziv ziv May 17 '23 at 10:10 — ziv ziv, May 17 '23 at 10:10

How to use GitHub Actions secrets in k8s Job env?

1 Answers1