<p>Hi I am playing around with Kubernetes secrets.
My deployment file is :</p>

<pre><code>---
apiVersion: v1
kind: Secret
metadata:
  name: my-secrets
  labels:
    app: my-app
data:
  username: dXNlcm5hbWU=
  password: cGFzc3dvcmQ=
</code></pre>

<p>I am able to create secrets and I am mounting them in my deployments as below:</p>

<pre><code>---
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: my-service
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: NodePort

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: spring-service
  labels:
    app: spring-service
spec:
  replicas: 1
  selector:
    matchLabels:
      app: spring-service
  template:
    metadata:
      labels:
        app: spring-service
    spec:
      containers:
      - name: spring-service
        image: my-image:tag
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: my-secret-vol
          mountPath: "/app/secrets/my-secret"
          readOnly: true            
      volumes:
      - name: my-secret-vol
        secret:
          secretName: my-secrets
</code></pre>

<p>My question is how can I access <code>username</code> and <code>password</code> I created in secret in spring-boot app?</p>

<p>I have tried loading in with <code>${my-secrets.username}</code> and <code>${username}</code>, but it fails to find values.</p>

<p>I also tried adding secrets as enviroment variables as below in deployment.yml:</p>

<pre><code>env:
- name: username
  valueFrom:
    secretKeyRef:
      name: my-secrets
      key: username
- name: password
  valueFrom:
    secretKeyRef:
      name: my-secrets
      key: password
</code></pre>

<p>In this case, values are loaded from secrets and when I change values of secrets in minikube dashboard, it does not reflect the changes.</p>

<p>Please help me to understand how this works.</p>

<p>I am using <code>minikube</code> and <code>docker</code> as containers</p>

<p>You don't inject the secret into <code>properties.yml</code>. Instead, you use the content of the secret as <code>properties.yml</code>. The process is look like the following:</p>

<ul>
<li>Create a <code>properties.yml</code> with the sensitive data (e.g. password)</li>
<li>Base64 encode this file (e.g. <code>base64 properties.yml</code>).</li>
<li>Take the base64 encoded value and put that in the secret under the key <code>properties.yaml</code>.</li>
</ul>

<p>You should end up with a secret in the following format:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: my-secrets
  labels:
    app: my-app
data:
  properties.yml: dXNlcm5hbWU=
</code></pre>

<p>Now when you mount this secret on your pod, Kubernetes will decrypt the secret and put the value under the relevant path and you can just mount it. </p>

<p>The pattern is to have 2 configuration files - one with non-sensitive configurations that is stored with the code, and the second (which includes sensitive configurations) stored as a secret. I don't know if that possible to load multiple config files using Spring Boot.</p>

<p>And one final comment - this process is cumbersome and error-prone. Each change to the configuration file requires decoding the original secret and repeating this manual process. Also, it's very hard to understand what changed - all you see is the entire content has changed. For that reason, we build <a href="https://github.com/Soluto/kamus" rel="nofollow noreferrer">Kamus</a>. It let you encrypt only the sensitive value instead of the entire file. Let me know if that could be relevant for you :)</p>
