<p>I have mounted two tar files as secrets. I would like to mount them to my container and then unpack the contents. The commands that created the secrets are as follows:</p>
<pre><code>kubectl create secret generic orderer-genesis-block --from-file=./channel-artifacts/genesis.block

kubectl create secret generic crypto-config --from-file=crypto-config.tar

kubectl create secret generic channel-artifacts --from-file=channel-artifacts.tar
</code></pre>
<p>The following is what I <code>kubectl apply</code>:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: fabric-orderer-01
spec:
  selector:
    matchLabels:
      app: fabric-orderer-01
  replicas: 1
  template:
    metadata:
      labels:
        app: fabric-orderer-01
    spec:
      initContainers:
      - name: init-channel-artifacts
        image: busybox
        volumeMounts:
        - name: channel-artifacts
          mountPath: /hlf/channel-artifacts
        command: ['sh', '-c', 'tar -xf /hlf/channel-artifacts/channel-artifacts.tar']
      containers:
      - name: fabric-orderer-01
        image: hyperledger/fabric-orderer:1.4.9
        env:
        - name: ORDERER_CFG_PATH
          value: /hlf/
        - name: CONFIGTX_ORDERER_ADDRESSES
          value: &quot;orderer.example.com:7050&quot;
        - name: ORDERER_GENERAL_LISTENADDRESS
          value: 0.0.0.0
        - name: ORDERER_GENERAL_LISTENPORT
          value: &quot;7050&quot;
        - name: ORDERER_GENERAL_LOGLEVEL
          value: debug
        - name: ORDERER_GENERAL_LOCALMSPID
          value: OrdererMSP
        - name: ORDERER_GENERAL_GENESISMETHOD
          value: file
        - name: ORDERER_GENERAL_GENESISFILE
          value: /hlf/genesis.block
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: fabricfiles-01
          mountPath: /fabric
        - name: orderer-genesis-block
          mountPath: /hlf/
          readOnly: true
        - name: crypto-config
          mountPath: /hlf/crypto-config
          readOnly: true
        - name: channel-artifacts
          mountPath: /hlf/channel-artifacts
          readOnly: true
      volumes:
      - name: orderer-genesis-block
        secret:
          secretName: orderer-genesis-block
      - name: crypto-config
        secret:
          secretName: crypto-config
      - name: channel-artifacts
        secret:
          secretName: channel-artifacts
      - name: fabricfiles-01
        persistentVolumeClaim:
          claimName: fabric-pvc-01
</code></pre>
<p>My deployment succeeds, but when I <code>bash</code> into my pod, I don't see my tar files being extracted. I only see my tar files <code>/hlf/channel-artifacts/channel-artifacts.tar</code> and <code>/hlf/crypto-config/crypto-config.tar</code>. How should I go about extracting their contents?</p>

<p>When you create an initContainer and execute this command:</p>
<p><code>command: ['sh', '-c', 'tar -xvf /hlf/channel-artifacts/channel-artifacts.tar']</code></p>
<p>it runs in default for this container path.
I checked this by adding <code>pwd</code> and <code>ls -l</code> commands.</p>
<p>Whole line is:</p>
<p><code>command: ['sh', '-c', 'tar -xvf /hlf/channel-artifacts/channel-artifacts.tar ; pwd ;  ls -l']</code></p>
<p>From an initContainer you can get logs by:</p>
<p><code>kubectl logs fabric-orderer-01-xxxxxx -c init-channel-artifacts</code></p>
<p>Output was:</p>
<pre><code>channel-artifacts.txt # first line for -v option so tar was untared indeed
/ # working directory
total 44
drwxr-xr-x    2 root     root         12288 May  3 21:57 bin
-rw-rw-r--    1 1001     1002            32 May 10 14:15 channel-artifacts.txt # file which was in tar
drwxr-xr-x    5 root     root           360 May 11 08:41 dev
drwxr-xr-x    1 root     root          4096 May 11 08:41 etc
drwxr-xr-x    4 root     root          4096 May 11 08:41 hlf
drwxr-xr-x    2 nobody   nobody        4096 May  3 21:57 home
dr-xr-xr-x  225 root     root             0 May 11 08:41 proc
drwx------    2 root     root          4096 May  3 21:57 root
dr-xr-xr-x   13 root     root             0 May 11 08:41 sys
drwxrwxrwt    2 root     root          4096 May  3 21:57 tmp
drwxr-xr-x    3 root     root          4096 May  3 21:57 usr
drwxr-xr-x    1 root     root          4096 May 11 08:41 var
</code></pre>
<p>As you can see your file is stored in <code>/</code> path of the container which means when this container is terminated, its filesystem is terminated as well and your file is gone.</p>
<p>Once we know what happened, it's time to workaround it.
First and impotant thing is secrets are read-only and should be used in prepared form, you can't write file to secret like you wanted to do in your example.</p>
<p>Instead one of the options is you can untar your secrets to a persistent volume:</p>
<p><code>command: ['sh', '-c', 'tar -xvf /hlf/channel-artifacts/channel-artifacts.tar -C /hlf/fabric']</code></p>
<p>And then use <code>postStart hook</code> for the main container where you can e.g. copy your files to desired locations or create simlinks and you won't need to mount your secrets to the main container.</p>
<p>Simple example of <code>postStart hook</code> (<a href="https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/" rel="nofollow noreferrer">reference</a>):</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: lifecycle-demo
spec:
  containers:
  - name: lifecycle-demo-container
    image: nginx
    lifecycle:
      postStart:
        exec:
          command: [&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;echo Hello from the postStart handler &gt; /usr/share/message&quot;]
</code></pre>
<p>Small notice is</p>
<blockquote>
<p>Kubernetes sends the postStart event immediately after the Container
is created. There is no guarantee, however, that the postStart handler
is called before the Container's entrypoint is called.</p>
</blockquote>
<p>To workaround it you can add <code>sleep 5</code> in your main container before entrypoint. Here's an example of a beginning of container section with nginx image (for your image it'll be different):</p>
<pre><code>containers:
      - name: main-container
        image: nginx
        command: [&quot;bash&quot;, &quot;-c&quot;, 'sleep 5 ; echo &quot;daemon off;&quot; &gt;&gt; /etc/nginx/nginx.conf ; nginx']
</code></pre>
<p>This will fix your issue. Also you can use this approach for untar your files and you won't even need an <code>initContainer</code></p>
<p>It's not clear why you want to use <code>tar</code> for this purpose as you can store small files in <code>secrets</code> or <code>configmaps</code> and mount them directly using <code>subPath</code> where they are needed without additional steps (you can read about it and find an example <a href="https://dev.to/joshduffney/kubernetes-using-configmap-subpaths-to-mount-files-3a1i" rel="nofollow noreferrer">here</a>)</p>
<p>To use secrets securely, you should consider e.g. <code>HashiCorp Vault</code> (<a href="https://www.hashicorp.com/products/vault/kubernetes" rel="nofollow noreferrer">Vault with kubernetes</a>)</p>
