<p>I am working on Java <strong>Springboot</strong> with <strong>MongoDB</strong> using <strong>Kubernetes</strong>. Currently I just hard coded the URI in application properties and I would like to know </p>

<p>how can I access to the MongoDB credentials on Kubernetes with Java? </p>

<p>If I properly understood the question, it is <em>specifically</em> about Java Spring Boot applications running on Kubernetes.</p>

<p>Few options come to my mind...some not that secure or exclusive to running on Kubernetes but still mentioned here:</p>

<ul>
<li><p>Environment variables with values in the <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#define-an-environment-variable-for-a-container" rel="nofollow noreferrer">deployment/pod configuration</a>. Everyone with access to the configuration will be able to see them. </p>

<p>Use <code>${&lt;env-var&gt;}</code> / <code>${&lt;end-var&gt;:&lt;default-value&gt;}</code> to access the environment variables in Spring Boot's <code>application.properties/.yaml</code> file. For example, if <code>DB_USERNAME</code> and <code>DB_PASSWORD</code> are two such environment variables:</p>

<pre><code>spring.data.mongodb.username = ${DB_USERNAME}
spring.data.mongodb.password = ${DB_PASSWORD}
</code></pre>

<p>...or</p>

<pre><code>spring.data.mongodb.uri = mongodb://${DB_USERNAME}:${DB_PASSWORD}@&lt;host&gt;:&lt;port&gt;/&lt;dbname&gt;
</code></pre>

<p>This will work regardless whether the application uses <code>spring.data.mongodb.*</code> properties or properties with custom names injected in a <code>@Configuration</code> class with <code>@Value</code>.</p></li>
<li><p>Based on how the Java application is started in the container, <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#define-a-command-and-arguments-when-you-create-a-pod" rel="nofollow noreferrer">startup arguments</a> can be defined in the deployment/pod configuration, similarly to the bullet point above.</p></li>
<li><p>Environment variables with values populated from <a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data" rel="nofollow noreferrer">secret(s)</a>. Access the environment variables from SpringBoot as above.</p></li>
<li><p><a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="nofollow noreferrer">Secrets as files</a> - the secrets will "appear" in a file dynamically added to the container at some location/directory; it would require you to define your own <code>@Configuration</code> class that loads  the user name and password from the file using <code>@PropertySource</code>.</p></li>
<li><p>The whole <code>application.properties</code> could be put in a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/" rel="nofollow noreferrer">ConfigMap</a>. Notice that the properties will be in clear text. Then <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#populate-a-volume-with-data-stored-in-a-configmap" rel="nofollow noreferrer">populate a Volume</a> with the ConfigMap so that <code>application.properties</code> will be added to the container at some location/directory. <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-application-property-files" rel="nofollow noreferrer">Point</a> Spring Boot to that location using <code>spring.config.location</code> as env. var, system property, or <em>program</em> argument.</p></li>
<li><p><a href="https://cloud.spring.io/spring-cloud-vault/reference/html/" rel="nofollow noreferrer">Spring Cloud Vault</a></p></li>
<li><p>Some other external vault-type of secure storage - an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">init container</a> can fetch the db credentials and make them available to the Java application in a file on a shared volume in the same pod.</p></li>
<li><p>Spring Cloud Config...even though it is unlikely you'd want to put db credentials in its default implementation of the server storage backend - git.</p></li>
</ul>
