Loading environment variables from secrets in Kubernetes
11 jul 2019 | kubernetes | secrets
In Kubernetes, it's a good idea to keep your environment variables in secrets.
You can do this by using kubectl:
$ kubectl create secret generic my-env-vars \
--from-literal="VAR1=myhost.yellowduck.be" \
--from-literal="VAR2=production"
One of the frequent use cases is to use these environment variables from a container in a deployment. You can reference them as follows:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-deployment
labels:
app: my-deployment
spec:
replicas: 1
selector:
matchLabels:
app: my-deployment
template:
metadata:
labels:
app: my-deployment
spec:
containers:
- name: my-deployment
image: <my-docker-user>/<my-docker-private-repo<
imagePullSecrets:
- name: <my-secret-name>
envFrom:
- secretRef:
name: my-env-vars
The nice thing is that you can combine the environment variables from multiple secrets. Imagine you have two secrets containing environment variables:
$ kubectl create secret generic my-env-vars1 \
--from-literal="VAR1=myhost.yellowduck.be" \
--from-literal="VAR2=production"
$ kubectl create secret generic my-env-vars2 \
--from-literal="VAR3=secret-key" \
--from-literal="VAR4=db-conn"
You can use both in your deployment by adding two secretRef values (as envFrom is an array):
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-deployment
labels:
app: my-deployment
spec:
replicas: 1
selector:
matchLabels:
app: my-deployment
template:
metadata:
labels:
app: my-deployment
spec:
containers:
- name: my-deployment
image: <my-docker-user>/<my-docker-private-repo<
imagePullSecrets:
- name: <my-secret-name>
envFrom:
- secretRef:
name: my-env-vars1
- secretRef:
name: my-env-vars2