<p>I am deploying my application in kubernetes using helm chart with 2 sub-charts <code>app</code> and <code>test</code>.</p>
<p>I have the pod of <code>app</code> chart properly running.
But <code>test</code> pod will be running only if it can properly authenticate to <code>app</code> container.</p>
<p>That means, i have to generate an <code>auth_token</code> using a curl request to <code>app</code> service and then add that token as Environment variable <code>AUTH_TOKEN</code> for <code>test</code> container.</p>
<p>I tried different ways to achieve this:</p>
<ul>
<li><p>Added an init-container <code>generate-token</code> for <code>test</code> pod, that will generate the token and will save it in a shared volume. And <code>test</code> container will have access to that volume. But the problem here is, the <code>test</code> container doesn't have a code to set env for the container by reading from the shared volume.</p>
</li>
<li><p>Added a sidecar-container <code>sidecar-generate-token</code> instead of an init-container for the same setup as mentioned above. Here also problem is, the <code>test</code> container doesn't have a code to set env for the container by reading from the shared volume. And also, the test pod got into a crashloopbackoff state. If you check the content of volume by getting into the container, there are multiple tokens in the volume file which are generated on each pod restart of crashloopbackoff.</p>
</li>
<li><p>Third plan was that an init-container <code>generate-token</code> should create a kubernetes secret in the cluster, after generating the auth_token. Then the main container <code>test</code> can set Environment variable from that secret. For that, the init container <code>generate-token</code> should have a kubectl setup in it first.</p>
</li>
</ul>
<p>If i am proceeding with the third plan, How can i setup and use kubectl from init-container to generate secret in the cluster?</p>
<p>Is there any other alternative plan to achieve this goal?</p>
<p><strong>EDIT:</strong></p>
<hr />
<p>This is the yaml part for the first option:</p>
<pre><code>  initContainers:
    - name: generate-service-token
      image: app.mycr.io/alpine-network-troubleshooting:dev-latest
      command:
      - /bin/sh
      - -c
      - |
        BEARER_TOKEN=$(curl -k -X POST -H &quot;Content-Type:application/json&quot; --data '{&quot;user&quot;:&quot;dynizer&quot;,&quot;password&quot;:&quot;xxxx&quot;}' &quot;https://app:50051/api/v2/login&quot; | jq -r '.jwt')
        SERVICE_TOKEN=$(curl -k -X GET -H 'Accept: application/json' -H &quot;Authorization: Bearer ${BEARER_TOKEN}&quot; &quot;https://app:50051/api/v2/servicetoken/issue&quot; | jq -r '.token')
        echo $SERVICE_TOKEN
        mkdir -p /vol
        touch /vol/token.txt
        echo $SERVICE_TOKEN &gt;&gt; /vol/token.txt
      volumeMounts:
        - mountPath: /vol
          name: token-vol    
  containers:              
    - name: nginx-container
      image: nginx
      volumeMounts:
      - name: token-vol
        mountPath: /vol                                             
  volumes:
    - name: token-vol
      emptyDir: {}   
</code></pre>

<p>Trying to answer your question:</p>
<blockquote>
<p>But still the same problem of container not having the code to set env by reading from the shared volume, will be there.</p>
</blockquote>
<p>Let's try to read this env from other container. Here Is what I have come up with.</p>
<p>First you need to know what command your container is running. In case of nginx that is <code>/docker-entrypoint.sh nginx -g &quot;daemon off;&quot;</code> (<a href="https://github.com/nginxinc/docker-nginx/blob/464886ab21ebe4b036ceb36d7557bf491f6d9320/mainline/debian/Dockerfile#L110-L116" rel="nofollow noreferrer">source code</a>)</p>
<p>Then you use <code>command</code> field where you read the token value from file and use <code>env</code> to set it and run the actual applciation.</p>
<p>Example:</p>
<pre><code>  initContainers:
    - name: generate-service-token
      image: app.mycr.io/alpine-network-troubleshooting:dev-latest
      command:
      - /bin/sh
      - -c
      - |
        BEARER_TOKEN=$(curl -k -X POST -H &quot;Content-Type:application/json&quot; --data '{&quot;user&quot;:&quot;dynizer&quot;,&quot;password&quot;:&quot;xxxx&quot;}' &quot;https://app:50051/api/v2/login&quot; | jq -r '.jwt')
        SERVICE_TOKEN=$(curl -k -X GET -H 'Accept: application/json' -H &quot;Authorization: Bearer ${BEARER_TOKEN}&quot; &quot;https://app:50051/api/v2/servicetoken/issue&quot; | jq -r '.token')
        echo $SERVICE_TOKEN
        mkdir -p /vol
        touch /vol/token.txt
        echo $SERVICE_TOKEN &gt;&gt; /vol/token.txt
      volumeMounts:
        - mountPath: /vol
          name: token-vol    
  containers:              
    - name: nginx-container
      image: nginx
      command:
      - sh
      - -c
      - exec env SERVICE_TOKEN=$(cat /vol/token.txt) /docker-entrypoint.sh nginx -g &quot;daemon off;&quot;
      volumeMounts:
      - name: token-vol
        mountPath: /vol                                             
  volumes:
    - name: token-vol
      emptyDir: {}   
</code></pre>
<p>More general example:</p>
<pre><code>  command:
  - sh
  - -c
  - exec env SERVICE_TOKEN=$(cat /vol/token.txt) &lt;&lt;any command&gt;&gt;
</code></pre>
<p>I am not sure if this is the best example, but I hope that at least it gives you an idea how you can approach this problem.</p>
