Assigning configmap entries to container's env variables

user_919158 0
Viewed 98

I have below ConfigMap code which pulls secrets from GSM.

kind: ConfigMap
metadata:
  name: db-config
  labels:
    app: poc
data:
  entrypoint.sh: |
    #!/usr/bin/env bash
    set -euo pipefail
    echo $(gcloud secrets versions access --project=<project> --secret=<secret-name>) >> /var/config/dburl.env
---
apiVersion: v1
kind: Pod
metadata:
  name: poc-pod
  namespace: default
spec:
  initContainers:
    - image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
      name: init
      command: ["/tmp/entrypoint.sh"]
      volumeMounts:
        - mountPath: /tmp
          name: entrypoint
        - mountPath: /var/config
          name: secrets
  volumes:
    # volumes mounting
    ...
  containers:
    - image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
      name: my-container
    volumeMounts:
      - mountPath: /var/config
        name: secrets
    env:
      - name: HOST
      ?? # Assign value fetched in configmap

How to assign values from CM created files to container's env variables? Or, is there any other approach available to achieve this?

I need send couple of env variable to Spring cloud config service. It's hard to find any guide/documentation for this. Any help is appreciated!

configmap kubernetes google-cloud-platform
1 Answers

One of the best ways to access secrets in google secret manager from GKE is by using the operator External Secret Operator, you can install it easily using helm.

Once is installed, you create a service account with the role roles/secretmanager.secretAccessor, then you download the creds (key file) and save them in a k8s secret:

kubectl create secret generic gcpsm-secret --from-file=service-account-credentials=key.json

Then you can define your secret store (it is not execlusive for GCP, it works with other secret manager such as AWS secret manager...):

apiVersion: external-secrets.io/v1alpha1
kind: SecretStore
metadata:
  name: gcp-secret-manager
spec:
  provider:
      gcpsm:                                                  
        auth:
          secretRef:
            secretAccessKeySecretRef:
              name: gcpsm-secret    # the secret you created in the first step
              key: service-account-credentials                              
        projectID: <your project id>

Now, you can create an external secret, and the operator will read the secret from the secret manager and create a k8s secret for you

apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: gcp-external-secret
spec:
  secretStoreRef:
    kind: SecretStore
    name: gcp-secret-manager          
  target:                                                             
    name: k8s-secret # the k8s secret name
  data:                                                       
  - secretKey: host # the key name in the secret 
    remoteRef:            
      key: <secret-name in gsm>

Finally in your pod, you can access the secret by:

apiVersion: v1
kind: Pod
metadata:
  name: poc-pod
  namespace: default
spec:
  initContainers:
    - image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
      name: init
      command: ["/tmp/entrypoint.sh"]
      volumeMounts:
        - mountPath: /tmp
          name: entrypoint
        - mountPath: /var/config
          name: secrets
  volumes:
    # volumes mounting
    ...
  containers:
    - image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
      name: my-container
    volumeMounts:
      - mountPath: /var/config
        name: secrets
    env:
      - name: HOST
        valueFrom:
          secretKeyRef:
            name: k8s-secret
            key: host

If you update the secret value in the secret manager, you should recreate the external secret to update the k8s secret value.

user_95605940
Related