<p>I need to add jks file to my JVM for SSL Handshake with the server. The JKS is mounted in volume and available to the docker container. How do I pass the JKS truststore path and password to the Springboot(JVM) during start up.
One option I think is as an environment variables (-Djavax.net.ssl.trustStore, -Djavax.net.ssl.trustStorePassword) . For Openshift, following works as described in the url below.</p>
<p>Option 1:</p>
<pre><code>      env:
          - name: JAVA_OPTIONS
            value: -Djavax.net.ssl.trustStore=/var/run/secrets/java.io/keystores/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit
</code></pre>
<p><a href="https://developers.redhat.com/blog/2017/11/22/dynamically-creating-java-keystores-openshift/" rel="nofollow noreferrer">https://developers.redhat.com/blog/2017/11/22/dynamically-creating-java-keystores-openshift/</a></p>
<p>But, I don't seem to find similar JAVA_OPTIONS environment variable for Kubernetes.</p>
<p>Option2 :</p>
<p>My Docker file is:</p>
<pre><code>FROM openjdk:8-jre-apline
..........
........
ENTRYPOINT [&quot;java&quot;, &quot;-jar&quot;, &quot;xxx.jar&quot;]
</code></pre>
<p>Can this be changed as below and the $JAVA_OPTS can be set as env variable to JVM via configmap?</p>
<pre><code>FROM openjdk:8-jre-apline
..........
........
ENTRYPOINT [ &quot;sh&quot;, &quot;-c&quot;, &quot;java $JAVA_OPTS -jar xxx.jar&quot; ]
</code></pre>
<p>Configmap:</p>
<pre><code>JAVA_OPTS: &quot;-Djavax.net.ssl.trustStore=/var/run/secrets/java.io/keystores/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit&quot;
</code></pre>
<p>Please suggest if this would work or anyother better solutions. More preferred if we can get store the password in secret.</p>

<p>A couple of options:</p>
<p><strong>1:</strong> You can break it all up and use <a href="https://kubernetes.io/docs/concepts/configuration/secret/#:%7E:text=Using%20Secrets%20as%20environment%20variables&amp;text=Create%20a%20secret%20or%20use,key%20you%20wish%20to%20consume." rel="nofollow noreferrer">secrets</a> to store your credentials only as env vars, secret to store the keystore which can be mounted as a file on disk in the container, and a ConfigMap to hold other java options as env variables then use an entrypoint script in your container to validate and mash it all together to form the JAVA_OPTS string.</p>
<p><strong>2:</strong> You can put the whole string in a JAVA_OPTS secret that you consume at run-time.</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: myimage
    env:
      - name: JAVA_OPTS
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: JAVA_OPTS
  restartPolicy: Never
</code></pre>
