<p>I have a spring boot application with some properties as below in my application.properties.</p>

<pre><code>server.ssl.keyStore=/users/admin/certs/appcert.jks
server.ssl.keyStorePassword=certpwd
server.ssl.trustStore=/users/admin/certs/cacerts
server.ssl.trustStorePassword=trustpwd
</code></pre>

<p>Here the cert paths are hardcoded to some path. But, I dont want to hard code this as the path will not be known in Mesos or Kubernetes world.</p>

<p>I have a docker file as follows.</p>

<pre><code>FROM docker.com/base/jdk1.8:latest

MAINTAINER Application Engineering [ https://docker.com/ ]

RUN mkdir -p /opt/docker/svc

COPY application/weather-service.war /opt/docker/svc/

CMD java -jar /opt/docker/svc/weather-service.war --spring.config.location=file:/conf/application.properties -Dlogging.config=/conf/logback.xml
</code></pre>

<p>Here, I can use the volume mount option in kubernetes so as to place the application.proerties.</p>

<p>How can i achieve the same thing for cert files in the application.properties?</p>

<p>Here, the cert props are optional for few applications and mandatory for few applications.</p>

<p>I need options to integrate within the docker images and having the cert files outside the docker image.</p>

<p><strong>Approach 1</strong>. Within the docker image</p>

<p>Remove the property "server.ssl.keyStore" from application.properties and pass it as a environment variable like the below one.</p>

<blockquote>
  <p>CMD java -jar /opt/docker/svc/weather-service.war
  --spring.config.location=file:/conf/application.properties -Dlogging.config=/conf/logback.xml  -Dserver.ssl.keyStore=/certs/appcert.jks</p>
</blockquote>

<p>Now, the cert should be places in secrets and use the volume mount options with kubernetes.</p>

<p><strong>Approach 2</strong>. No need to have -Dserver.ssl.keyStore=/certs/appcert.jks in the docker file, but still remove the property "server.ssl.keyStore" from application.properties and do as follows.</p>

<p>a. Create secret</p>

<blockquote>
  <p>kubectl create secret generic svc-truststore-cert
  --from-file=./cacerts</p>
</blockquote>

<p>b. Create one env variable as below.</p>

<blockquote>
  <p>{
            "name": "JAVA_OPTS",
            "value": "-Dserver.ssl.trustStore=/certs/truststore/cacerts"
           }</p>
</blockquote>

<p>c. Create Volume mounts under container for pod.</p>

<blockquote>
  <p>"volumeMounts": [
            {
              "name": "truststore-cert",
              "mountPath": "/certs/truststore"
            }
          ]</p>
</blockquote>

<p>d. Create a volume under spec.</p>

<blockquote>
  <p>{
              "name": "truststore-cert",
              "secret": {
                "secretName": "svc-truststore-cert",
                "items": [
                  {
                    "key": "cacerts",
                    "path": "cacerts"
                  }
                ]
              }
            }</p>
</blockquote>

<p><strong>Approach 3</strong>.  </p>

<p>Using Kubernetes Persistent Volume.</p>

<p>Created a persistent volume on Kubernetes .</p>

<p>Mount the volume to the Pod of each microservice (changes in the pod script file). Mounted file system accessible via - '/shared/folder/certs' path.</p>

<blockquote>
  <p>CMD java -jar /opt/docker/svc/weather-service.war
  --spring.config.location=file:/conf/application.properties -Dlogging.config=/conf/logback.xml -Dserver.ssl.keyStore=/certs/appcert.jks</p>
</blockquote>

<p>I have taken the second approach. Is this correct? Is there any other better approach?</p>

<p>Thanks</p>

<p>Yes, the second approach is the best one, and it is the only way if you are storing some sensitive data like certificates, keys, etc. That topic is covered in the <a href="https://kubernetes.io/docs/concepts/configuration/secret/#overview-of-secrets" rel="nofollow noreferrer">documentation</a>.</p>

<p>Moreover, you can <a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="nofollow noreferrer">encrypt</a> your secrets to add another level of protection.</p>
