<p>I am using kubernetes to deploy a rails app to google container engine.</p>

<p>Follow the kubernetes secrets document: <a href="http://kubernetes.io/v1.1/docs/user-guide/secrets.html" rel="nofollow">http://kubernetes.io/v1.1/docs/user-guide/secrets.html</a></p>

<p>I created a web controller file:</p>

<pre><code># web-controller.yml
apiVersion: v1
kind: ReplicationController
metadata:
  labels:
    name: web
  name: web-controller
spec:
  replicas: 2
  selector:
    name: web
  template:
    metadata:
      labels:
        name: web
    spec:
      containers:
      - name: web
        image: gcr.io/my-project-id/myapp:v1
        ports:
        - containerPort: 3000
          name: http-server
        env:
          secret:
          - secretName: mysecret
</code></pre>

<p>And created a secret file:</p>

<pre><code># secret.yml
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  RAILS_ENV: production
</code></pre>

<p>When I run:</p>

<pre><code>kubectl create -f web-controller.yml
</code></pre>

<p>It showed:</p>

<pre><code>error: could not read an encoded object from web-controller.yml: unable to load "web-controller.yml": json: cannot unmarshal object into Go value of type []v1.EnvVar
error: no objects passed to create
</code></pre>

<p>Maybe the yaml format is wrong in the <code>web-controller.yml</code> file. Then how to write?</p>

<p>secret.yml</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
stringData:
  RAILS_ENV: production
</code></pre>

<p>stringData is the easymode version of what you're after, one thing though.
you'll see the cleartext original yaml used to create the secret in the annotation (and if you used the above method that means you'll have a human readable secret in your annotation, if you use the below method you'll have the base64'd secret in your annotation), unless you follow up with the erase annotation command like so:</p>

<p><strong>kubectl apply -f secret.yml <br>
kubectl annotate secret mysecret kubectl.kubernetes.io/last-applied-configuration- <br></strong>
(the - at the end is what says to erase it) <br>
<strong>kubectl get secret mysecret -n=api -o yaml <br></strong>
(to confirm)</p>

<p>Alternatively you'd do<br>
<strong>Bash# echo production | base64 <br></strong>
cHJvZHVjdGlvbgo=</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  RAILS_ENV: cHJvZHVjdGlvbgo=
</code></pre>
