<p>I've followed the steps at <a href="https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine" rel="noreferrer">https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine</a> to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.</p>

<p>My issue is that in the code I copied from the site:</p>

<pre><code>- name: cloudsql-proxy
  image: gcr.io/cloudsql-docker/gce-proxy:1.11
  command: ["/cloud_sql_proxy",
            "-instances=&lt;INSTANCE_CONNECTION_NAME&gt;=tcp:3306",
            "-credential_file=/secrets/cloudsql/credentials.json"]
  securityContext:
    runAsUser: 2  # non-root user
    allowPrivilegeEscalation: false
  volumeMounts:
    - name: cloudsql-instance-credentials
      mountPath: /secrets/cloudsql
      readOnly: true
</code></pre>

<p>the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.</p>

<p>I think I'm supposed to create the credentials as a secret via </p>

<p><code>kubectl create secret generic cloudsql-instance-credentials --from-file=k8s\secrets\my-credentials.json</code></p>

<p>But after that I have no idea what to do. How does this secret become the path <code>/secrets/cloudsql/credentials.json</code>?</p>

<p>Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.</p>

<ul>
<li>create secret/configmap</li>
<li>add a volume for the secret in <code>.spec.volumes</code> in the pod (if you deploy the pod using deployment then add volume in <code>.spec.template.spec.volumes</code>)</li>
<li>mount the created volume in <code>.spec.container[].volumemount</code></li>
</ul>

<p>Ref: <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets" rel="nofollow noreferrer">official kubernetes doc</a></p>

<p>There is a sample for your use case:</p>

<pre><code>  - name: cloudsql-proxy
    image: gcr.io/cloudsql-docker/gce-proxy:1.11
    command: ["/cloud_sql_proxy",
              "-instances=&lt;INSTANCE_CONNECTION_NAME&gt;=tcp:3306",
              "-credential_file=/secrets/cloudsql/credentials.json"]
    securityContext:
      runAsUser: 2  # non-root user
      allowPrivilegeEscalation: false
    volumeMounts:
      - name: cloudsql-instance-credentials
        mountPath: /secrets/cloudsql
        readOnly: true
volumes:
- name: cloudsql-instance-credentials
  secret:
    defaultMode: 511
    secretName: cloudsql-instance-credentials
</code></pre>
