<p>I've followed the steps at <a href="https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine" rel="noreferrer">https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine</a> to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.</p>

<p>My issue is that in the code I copied from the site:</p>

<pre><code>- name: cloudsql-proxy
  image: gcr.io/cloudsql-docker/gce-proxy:1.11
  command: ["/cloud_sql_proxy",
            "-instances=&lt;INSTANCE_CONNECTION_NAME&gt;=tcp:3306",
            "-credential_file=/secrets/cloudsql/credentials.json"]
  securityContext:
    runAsUser: 2  # non-root user
    allowPrivilegeEscalation: false
  volumeMounts:
    - name: cloudsql-instance-credentials
      mountPath: /secrets/cloudsql
      readOnly: true
</code></pre>

<p>the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.</p>

<p>I think I'm supposed to create the credentials as a secret via </p>

<p><code>kubectl create secret generic cloudsql-instance-credentials --from-file=k8s\secrets\my-credentials.json</code></p>

<p>But after that I have no idea what to do. How does this secret become the path <code>/secrets/cloudsql/credentials.json</code>?</p>

<p>you have to add a volume entry under the spec like so:</p>
<pre><code>  volumes:
    - name: cloudsql-instance-credentials
      secret:
        defaultMode: 420
        secretName: cloudsql-instance-credentials
</code></pre>
<p><strong>Note:</strong> This belongs to the deployment spec not the container spec.</p>
<p><em>Edit:</em> Further Information can be found here: <a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-pod-that-has-access-to-the-secret-data-through-a-volume" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-pod-that-has-access-to-the-secret-data-through-a-volume</a> thanks shalvah for pointing that out.</p>
