<p>I’m packaging a Python app for use within a Kubernetes cluster. In the code base this method exists :</p>
<pre><code>   def get_pymongo_client(self):
        username = test;
        password = 'test';
        url = ‘test
        conn_str = &quot;mongodb+srv://&quot; + username + &quot;:&quot; + password + “/”+ url

        return pymongo.MongoClient(conn_str)
</code></pre>
<p>I’m attempting to secure the username, password &amp; URL fields so that they are not viewable within the src code. For this, I plan to use secrets.</p>
<p>The URL <a href="https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/" rel="noreferrer">https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/</a> details how to create a secret. But I’m not sure how to read the secret from the Python app.</p>
<p>.Dockerfile for my app:</p>
<pre><code>#https://docs.docker.com/language/python/build-images/

FROM python:3.8-slim-buster

WORKDIR /app

COPY requirements.txt requirements.txt

RUN pip3 install -r requirements.txt

COPY . .

CMD [ &quot;python3&quot;, &quot;-m&quot; , &quot;flask&quot;, &quot;run&quot;, &quot;--host=0.0.0.0&quot;]
</code></pre>
<p>Reading <a href="https://stackoverflow.com/questions/65447044/python-flask-application-access-to-docker-secrets-in-a-swarm">Python flask application access to docker secrets in a swarm</a> details the use of secrets in a docker-compose file, is this also required for Kubernetes? What steps are involved in order to read secret parameters from the Python src code file?</p>

<p>The traditional way is via environment variable</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  containers:
  - name: your-app
    # ...
    env:
    - name: PYMONGO_USERNAME
      valueFrom:
        secretKeyRef:
           name: your-secret-name-here
           key: PYMONGO_USERNAME
</code></pre>
<p>Or you can make that yaml less chatty by using a well-formed Secret and the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#container-v1-core" rel="noreferrer">&quot;envFrom:&quot; field</a></p>
<pre class="lang-yaml prettyprint-override"><code>kind: Secret
metadata:
  name: pymongo
stringData:
  PYMONGO_USERNAME: test
  PYMONGO_PASSWORD: sekrit
---
spec:
  containers:
  - name: your-app
    envFrom:
    - secretRef:
        name: pymongo
    # and now the pod has all environment variables matching the keys in the Secret
</code></pre>
<p>and then your code would just read it from its environment as normal</p>
<pre class="lang-py prettyprint-override"><code>   def get_pymongo_client(self):
        username = os.getenv('PYMONGO_USERNAME')
        password = os.getenv('PYMONGO_PASSWORD')
        # etc
</code></pre>
<p>An alternative, but similar idea, is to <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#secretvolumesource-v1-core" rel="noreferrer">mount the Secret onto the filesystem</a>, and then read in the values as if they were files</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  containers:
  - name: your-app
    env:
    # this part is 100% optional, but allows for easier local development
    - name: SECRETS_PATH
      value: /secrets
    volumeMounts:
    - name: pymongo
      mountPath: /secrets 
  volumes:
  - name: pymongo
    secret:
      secretName: your-secret-name-here
</code></pre>
<p>then:</p>
<pre class="lang-py prettyprint-override"><code>   def get_pymongo_client(self):
        sec_path = os.getenv('SECRETS_PATH', './secrets')
        with open(os.path.join(sec_path, 'PYMONGO_USERNAME')) as fh:
            username = fh.read()
</code></pre>
