<p>I have a Spring boot application which is configured with https with the below properties.</p>

<pre><code>server.ssl.keyStore=/users/admin/certs/appcert.jks
server.ssl.keyStorePassword=certpwd
server.ssl.trustStore=/users/admin/certs/trustcert
server.ssl.trustStorePassword=trustpwd
</code></pre>

<p>These applications were running in VM's and the certs were placed in the defined path. Now, trying to deploy this application into Kubernetes and not sure how to achieve this. </p>

<p>I already have created mount for application.properties in configMap. 
In my dockerFile, </p>

<blockquote>
  <p>--spring.config.location=file:/conf/application.properties</p>
</blockquote>

<p>and in deployments.yaml like the below one. </p>

<pre><code>"spec": {
    "volumes": [
      {
        "name": "app-prop",
        "configMap": {
          "name": "app-config",
          "items": [
            {
              "key": "application.properties",
              "path": "application.properties"
            }
          ]
        }
      }
    ],
    "containers": [
      {
        "name": "app-service",
        "image": "docker.com/app-service",
        "volumeMounts": [
          {
            "name": "app-prop",
            "mountPath": "/conf"
          }
        ],
        "imagePullPolicy": "IfNotPresent"
      }
    ],
</code></pre>

<p>The property server.ssl.keyStore is in application.properties. </p>

<p>Since those keystores are password protected, arguably you could just bundle them into the docker image and reference them relative to the image's root, then inject the passwords via enviroment variables that are set from <code>Secret</code>s:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: spring-ssl
data:
  keyPass: bAsE64TxT
---
kind: Pod
# etc
containers:
- env:
  - name: SERVER_SSL_KEY_STORE_PASSWORD
    valueFrom:
      secretKeyRef:
        key: spring-ssl
        name: keyPass
</code></pre>

<p>Spring Boot will grab those correctly formatted environment variables and apply them on top of any other configuration values, yielding (hopefully) the correct assignment without having to hard-code the passwords anywhere easily accessible</p>

<p>However, if you'd prefer to keep even the jks out of the docker image, then one could feel free to stash the jks in the same <code>Secret</code>, or even a separate one, and <code>volumeMount</code> the jks in place</p>
