<p>I have a Replication Controller with one replica using a secret. How can I update or recreate its (lone) pod—without downtime—with latest secret value when the secret value is changed?</p>

<p>My current workaround is increasing number of replicas in the Replication Controller, deleting the old pods, and changing the replica count back to its original value. </p>

<p>Is there a command or flag to induce a rolling update retaining the same container image and tag? When I try to do so, it rejects my attempt with the following message:</p>

<pre><code>error: Specified --image must be distinct from existing container image
</code></pre>

<p>A couple of issues <a href="https://github.com/kubernetes/kubernetes/issues/9043" rel="nofollow">#9043</a> and <a href="https://github.com/kubernetes/kubernetes/issues/13488" rel="nofollow">#13488</a> describe the problem reasonably well, and I suspect a rolling update approach will eventuate shortly (like most things in Kubernetes), though unlikely for 1.3.0. The same issue applies with updating ConfigMaps.</p>

<p>Kubernetes will do a rolling update whenever anything in the deployment pod spec is changed (eg. typically <code>image</code> to a new version), so <a href="https://github.com/kubernetes/kubernetes/issues/13488#issuecomment-218103521" rel="nofollow">one suggested workaround</a> is to set an env variable in your deployment pod spec (eg. <code>RESTART_</code>)</p>

<p>Then when you've updated your secret/configmap, bump the env value in your deployment (via <code>kubectl apply</code>, or <code>patch</code>, or <code>edit</code>), and Kubernetes will start a rolling update of your deployment.</p>

<p>Example Deployment spec:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: test-nginx
spec:
  replicas: 2
  template:
    metadata:
    spec:
      containers:
      - name: nginx
        image: "nginx:stable"
        ports:
        - containerPort: 80
        - mountPath: /etc/nginx/conf.d
          name: config
          readOnly: true
        - mountPath: /etc/nginx/auth
          name: tokens
          readOnly: true
        env:
        - name: RESTART_
          value: "13"
      volumes:
        - name: config
          configMap:
            name: test-nginx-config
        - name: tokens
          secret:
            secretName: test-nginx-tokens
</code></pre>

<p>Two tips:</p>

<ul>
<li>your environment variable name can't start with an <code>_</code> or it magically disappears somehow. </li>
<li>if you use a number for your restart variable you need to wrap it in quotes</li>
</ul>
