<p>I have JupyterHub running on a kubernetes cluster in AWS EKS (managed kubernetes on AWS).</p>

<p>I need to know if there is any way for me to store or configure a sensitive secret that can be accessed during a notebook server instance startup, but only by the server processes. It should never be accessible by any normal users or malicious users.</p>

<p>Specifically, I have a custom "postStart" step, configured in my helm chart:</p>

<pre><code>proxy:
  # ...

auth
  # ...

singleuser:
  image:
    # ...
  lifecycleHooks:
    postStart:
      exec:
        command: ["/bin/sh", "-c", "custom-program -password abcdefg12345"] # &lt;-- THIS. 
</code></pre>

<p>How can I safely store my password, e.g. <code>abcdefg12345</code> above, so that it can <strong>never</strong> be accessible to any users of the JupyterHub cluster? (Except admins)</p>

<p>Would it be safe in the helm chart config file? Where does helm store the postStart lifecycleHook command?</p>

James Wierzba
<p>Kubernetes has the concept of <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer"><code>Secrets</code></a> and allows to configure <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">role-based access control</a> (RBAC) for these. For the <code>Pod</code> running your server you need to create a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="nofollow noreferrer"><code>ServiceAccount</code></a>.</p>
