<p>I have a spring boot app image which needs the following property.</p>

<p>server.ssl.keyStore=/certs/keystore.jks</p>

<p>I am loading the keystore file to secrets using the bewloe command.</p>

<p>kubectl create secret generic ssl-keystore-cert --from-file=./server-ssl.jks</p>

<p>I use the below secret reference in my deployment.yaml</p>

<pre><code>           {
            "name": "SERVER_SSL_KEYSTORE",
            "valueFrom": {
              "secretKeyRef": {
                "name": "ssl-keystore-cert",
                "key": "server-ssl.jks"
              }
            }
          }
</code></pre>

<p>With the above reference, I am getting the below error.</p>

<blockquote>
  <p>Error: failed to start container "app-service": Error response from
  daemon: oci runtime error: container_linux.go:265: starting container
  process caused "process_linux.go:368: container init caused \"setenv:
  invalid argument\"" Back-off restarting failed container</p>
</blockquote>

<p>If i go with the volume mount option,</p>

<pre><code>"spec": {
        "volumes": [
          {
            "name": "keystore-cert",
            "secret": {
              "secretName": "ssl-keystore-cert",
              "items": [
                {
                  "key": "server-ssl.jks",
                  "path": "keycerts"
                }
              ]
            }
          }
        ],
        "containers": [
          {
            "env": [
              {
                "name": "JAVA_OPTS",
                "value": "-Dserver.ssl.keyStore=/certs/keystore/keycerts"
              }
            ],
            "name": "app-service",
            "ports": [
              {
                "containerPort": 8080,
                "protocol": "TCP"
              }
            ],
            "volumeMounts": [
              {
                "name": "keystore-cert",
                "mountPath": "/certs/keystore"
              }
            ],
            "imagePullPolicy": "IfNotPresent"
          }
        ]
</code></pre>

<p>I am getting the below error with the above approach.</p>

<blockquote>
  <p>Caused by: java.lang.IllegalArgumentException: Resource location must
  not be null   at
  org.springframework.util.Assert.notNull(Assert.java:134)
  ~[spring-core-4.3.7.RELEASE.jar!/:4.3.7.RELEASE]  at
  org.springframework.util.ResourceUtils.getURL(ResourceUtils.java:131)
  ~[spring-core-4.3.7.RELEASE.jar!/:4.3.7.RELEASE]  at
  org.springframework.boot.context.embedded.jetty.JettyEmbeddedServletContainerFactory.configureSslKeyStore(JettyEmbeddedServletContainerFactory.java:301)
  ~[spring-boot-1.4.5.RELEASE.jar!/:1.4.5.RELEASE]</p>
</blockquote>

<p>I tried with the below option also, instead of JAVA_OPTS,</p>

<pre><code>{
                "name": "SERVER_SSL_KEYSTORE",
                "value": "/certs/keystore/keycerts"
              }
</code></pre>

<p>Still the error is same.</p>

<p>Not sure what is the right approach.</p>

<p>I tried to repeat the situation with your configuration. I created a secret used command:</p>

<pre><code>kubectl create secret generic ssl-keystore-cert --from-file=./server-ssl.jks
</code></pre>

<p>I used this YAML as a test environment:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: busybox
  namespace: default
spec:
  containers:
  - image: busybox
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
    name: busybox
    env:
    - name: JAVA_OPTS
      value: "-Dserver.ssl.keyStore=/certs/keystore/server-ssl.jks"
    ports:
    - containerPort: 8080
      protocol: TCP
    volumeMounts:
    - name: secret-volume
      readOnly: true
      mountPath: "/cert/keystore"
  volumes:
  - name: secret-volume
    secret:
      secretName: ssl-keystore-cert
</code></pre>

<p>As you see, I used "server-ssl.jks" file name in the variable. If you create the secret from a file, Kubernetes will store this file in the secret. When you mount this secret to any place, you just store the file. You tried to use <code>/certs/keystore/keycerts</code> but it doesn't exist, which you see in logs:</p>

<blockquote>
  <p>Resource location must not be null at org.springframework.util.Assert.notNull</p>
</blockquote>

<p>Because your mounted secret is here <code>/certs/keystore/keycerts/server-ssl.jks</code>  </p>

<p>It should work, but just fix the paths </p>
