<p>I'm using node js &amp; am wanting to upload files to a bucket of mine. I've setup the secret:</p>

<pre><code>NAME                         TYPE                                  DATA      AGE
cloudsql-oauth-credentials   Opaque                                1         5d
default-token-dv9kj          kubernetes.io/service-account-token   3         5d
</code></pre>

<p>The service_account does have access to my google cloud storage API as I've set that up already &amp; tested it locally (on my own computer). I'm unsure how I can reference the location of the <strong>service account</strong> json file?!</p>

<p>Here is my volumes mount:</p>

<pre><code>"volumes": [{
    "name": "cloudsql-oauth-credentials",
     "secret": {
         "secretName": "cloudsql-oauth-credentials"
     }
 }
</code></pre>

<p>Here is the code where I'm setting up the google-cloud storage variable:</p>

<pre><code>var gcs = require('@google-cloud/storage')({
  projectId: 'projectID-38838',
  keyFilename: process.env.NODE_ENV == 'production' 
      ? JSON.parse(process.env.CREDENTIALS_JSON) // Parsing js doesn't work
      : '/Users/james/auth/projectID-38838.json' // This works locally
});
var bucket = gcs.bucket('bucket-name');
</code></pre>

<p>Now if I want to use this inside my docker container on kubernetes, I'll have to reference the json file location...But I don't know where it is?!</p>

<p>I've tried setting the Credentials file as an environment variable, but I cannot parse a js object to the <strong>keyFilename</strong> object. I have to parse a file location. I set the env variable up like so:</p>

<pre><code>{           
 "name": "CREDENTIALS_JSON",
  "valueFrom": {
        "secretKeyRef": {
             "name": "cloudsql-oauth-credentials",
             "key": "credentials.json"
        }
   }
 },
</code></pre>

<p>How can I reference the location of the service_account json file inside my kubernetes pod?!</p>

<p>Look <a href="http://kubernetes.io/docs/user-guide/secrets/#using-secrets-as-files-from-a-pod" rel="noreferrer">here</a> in the section <strong>Using Secrets as Files from a Pod</strong>. </p>

<p>Basically, you need to specify two things when mounting a secret volume. The bit that you have + some extra info. <em>There might be some redundancies with the key but this is what I do and it works.</em></p>

<p>When creating a secret, create it with a key:<br>
<code>kubectl create secret generic cloudsql-oauth-credentials --from-file=creds=path/to/json</code></p>

<p>Then</p>

<pre><code>"volumes": [{
    "name": "cloudsql-oauth-credentials",
    "secret": {
        "secretName": "cloudsql-oauth-credentials"
        "items": [{
            "key": "creds",
            "path": "cloudsql-oauth-credentials.json"
        }]

    }
}
</code></pre>

<p>But then also specify where it goes in the container definiton (in Pod, Deployment, Replication Controller - whatever you use):</p>

<pre><code>"spec": {
    "containers": [{
        "name": "mypod",
        "image": "myimage",
        "volumeMounts": [{
            "name": "cloudsql-oauth-credentials",
            "mountPath": "/etc/credentials",
            "readOnly": true
        }]
}],
</code></pre>

<p>The file will be mapped to <code>/etc/credentials/cloudsql-oauth-credentials.json</code>. </p>
