<p>For my project I need a config file to connect my program to a database. Instead of writing the config data(for example username and password) hard coded in a document I want to save it as secure environment variables in kubernetes.</p>

<p>I programmed my application with python. The python application runs successfully in a docker container. I then created the secret variables via kubernetes. I wrote a .yaml file and specified the required container and image data.
That's the Kubernetes tutorial: <a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data" rel="nofollow noreferrer">Link to Kubernetes tutorial</a></p>

<p>Now I want to access the secret environment variables I created in kubernetes. But how?</p>

<p>How can I read a secret environment variable with python? Do I have to initialize the environment variables in the docker file?</p>

<p>PS: I already tried things like this:</p>

<pre><code>import os
print(os.environ['USERNAME'])
</code></pre>

<p>Th following works and should prove this to you:</p>

<h3>1. Base64 encode e.g. username|password:</h3>

<pre class="lang-sh prettyprint-override"><code>U=$(echo -n "freddie" | base64)
P=$(echo -n "fridays" | base64)
</code></pre>

<p><strong>NB</strong> The host's environment variables are <code>U</code> and <code>P</code></p>

<p>Assuming</p>

<pre class="lang-sh prettyprint-override"><code>POD="p"             # Or...
SECRET="s"          # Or...
NAMESPACE="default" # Or...
</code></pre>

<h3>2. Create the secret:</h3>

<pre class="lang-sh prettyprint-override"><code>echo "
apiVersion: v1
kind: Secret
metadata:
  name: ${SECRET}
data:
  u: ${U}
  p: ${P}
" | kubectl apply --filename=- --namespace=${NAMESPACE}
</code></pre>

<p><strong>NB</strong> The Secret's data contains values <code>u</code> and <code>p</code> (corresponding to <code>U</code> and <code>P</code>)</p>

<p>yields:</p>

<pre><code>secret/x created
</code></pre>

<p>And:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl describe secret/${SECRET} --namespace=${NAMESPACE}
</code></pre>

<p>yields:</p>

<pre><code>Name:         ${SECRET}
Namespace:    ${NAMESPACE}
Labels:       &lt;none&gt;
Annotations:  
Type:         Opaque

Data
====
p:  7 bytes
u:  7 bytes
</code></pre>

<h3>3. Attach the secret's values to a Pod:</h3>

<pre class="lang-sh prettyprint-override"><code>echo "
apiVersion: v1
kind: Pod
metadata:
  name: ${POD}
spec:
  containers:
  - name: test
    image: python
    command:
    - python3
    - -c
    - \"import os;print(os.environ['USERNAME']);print(os.environ['PASSWORD'])\"
    env:
    - name: USERNAME
      valueFrom:
        secretKeyRef:
          name: ${SECRET}
          key: u
    - name: PASSWORD
      valueFrom:
        secretKeyRef:
          name: ${SECRET}
          key: p
" | kubectl apply --filename=- --namespace=${NAMESPACE}
</code></pre>

<p><strong>NB</strong> The Pod's environment maps the Secret's <code>u</code>--><code>USERNAME</code>, <code>p</code>--><code>PASSWORD</code></p>

<p><strong>NB</strong> These variable name changes are to demonstrate the point; they may be the same</p>

<h3>4. Review the Pod's logs</h3>

<pre class="lang-sh prettyprint-override"><code>kubectl logs pod/${POD} --namespace=${NAMESPACE}
</code></pre>

<p>yields (in my case):</p>

<pre><code>freddie
fridays
</code></pre>
