<p>We are setting up a Jenkins-based CI pipeline on our Kubernetes cluster (Rancher if that matters) and up to now we have used the official <code>maven:3-jdk-11-slim</code> image for experiments.  Unfortunately it does not provide any built-in way of overriding the default settings.xml to use a mirror, which we need - preferably just by setting an environment variable.  I am not very familar with kubernetes so I may be missing something simple.</p>

<p>Is there a simple way to add a file to the image?  Should I use another image with this functionality built in?</p>

<pre><code>
pipeline {
    agent {
        kubernetes {
            yaml """
kind: Pod
metadata:
  name: kaniko
spec:
  containers:
  - name: maven
    image: maven:3-jdk-11-slim
    command:
    - cat
    tty: true
  - name: kaniko
.... etc
</code></pre>

<p><strong>Summary</strong>: you can mount <strong>your</strong> settings.xml file on the pod at some specific path and use that file with command <code>mvn -s /my/path/to/settings.xml</code>.</p>

<p>Crou's ConfigMap approach is one way to do it. However, since the <code>settings.xml</code> file usually contains credentials, I would treat it as <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">Secrets</a>.</p>

<p>You can create a Secret in Kubernetes with command:</p>

<pre><code>$ kubectl create secret generic mvn-settings --from-file=settings.xml=./settings.xml
</code></pre>

<p>The pod definition will be something like this:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: kaniko
spec:
  containers:
    - name: maven
      image: maven:3-jdk-11-slim
      command:
      - cat
      tty: true
      volumeMounts:
      - name: mvn-settings-vol
        mountPath: /my/path/to
  volumes:
    - name: mvn-settings-vol
      secret:
        secretName: mvn-settings
</code></pre>

<p><strong>Advanced/Optional</strong>: If you practice "Infrastructure as Code", you might want to save the manifest file for that secret for recovery. This can be achieved by this command after secret already created: </p>

<pre><code>$ kubectl get secrets mvn-settings -o yaml
</code></pre>

<p>You can keep <code>secrets.yml</code> file but do not check into any VCS/Github repo since this version of <code>secrets.yml</code> contains unencrypted data.</p>

<p>Some k8s administrators may have <a href="https://github.com/bitnami-labs/sealed-secrets" rel="noreferrer">kubeseal</a> installed. In that case, I'd recommend using kubeseal to get encrypted version of <code>secrets.yml</code>.</p>

<pre><code>$ kubectl create secret generic mvn-settings --from-file=settings.xml=./settings.xml --dry-run -o json | kubeseal --controller-name=controller --controller-namespace=k8s-sealed-secrets --format=yaml &gt;secrets.yml

# Actually create secrets
$ kubectl apply -f secrets.yml
</code></pre>

<p>The <code>controller-name</code> and <code>controller-namespace</code> should be obtained from k8s administrators. 
This <code>secrets.yml</code> contains encrypted data of your <code>settings.xml</code> and can be safely checked into VCS/Github repo.</p>
