<p>When i tried to deploy with K8S using env variable for Root Password (MYSQL_ROOT_PASSWORD , a variable used in docker-entrypoint.sh) such as</p>

<pre><code> kind: Deployment

#omitted...

 spec:
      containers:

  #omitted...

        env:
          - name: MYSQL_ROOT_PASSWORD
            value: my-secret-passw
</code></pre>

<p>it seems that the deployment with <code>kubectl apply -k</code> is working. Of course, this insecure deployment. MySql initialization works and everything is as expected.
So i tried to create a <code>secret</code> and retrieving the value from that <code>secret</code>,  such that </p>

<pre><code>kind: Deployment

#omitted...

 spec:
      containers:

  #omitted...

        env:
          - name: MYSQL_ROOT_PASSWORD
            valueFrom:
              secretKeyRef:
                key: MYSQL_ROOT_PASSWORD
                name: mysql-root-password
</code></pre>

<p>mysql initialization is not working. And i have no idea what the heck is going wrong. The <code>kubectl logs</code> or stdout from the container is the following (bear in mind that using literal root pass didn't return result like this):</p>

<pre><code>[MY-011323] [Server] X Plugin ready for connections. Socket: '/var/run/mysqld/mysqlx.sock'
Warning: Unable to load '/usr/share/zoneinfo/iso3166.tab' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/leap-seconds.list' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/zone.tab' as time zone. Skipping it.
Warning: Unable to load '/usr/share/zoneinfo/zone1970.tab' as time zone. Skipping it.
[Note] [Entrypoint]: /usr/local/bin/docker-entrypoint.sh: running /docker-entrypoint-initdb.d/sql-script.sql
mysql: [ERROR] unknown option '-- "'. 
</code></pre>

<p>When checking the docker image source code, it seems there is no string about "unknown option" (<a href="https://github.com/docker-library/mysql.git" rel="nofollow noreferrer">see here the github</a> and i am using mysql 8.0. It seems it's coming out of mysql itself.</p>

<p>So why is it that when using literal value on k8S env variable (which is not safe!) working but not with reading from <code>secret</code>?</p>

tepetrol
<p>After sometime, i realized that the problem is not with the Secret of K8S. I accidentally changed my password into string of chars <strong>without</strong> Special characters, and that solved it! From the post, you see that the character -- was read as an input of the next process (dang it, i am giving away my pass! nah, changed it already).
So anyone of you with the same problem (with mysql), please consider choosing a secret with no-special-characters password. Long password with combination of numbers/case-sensitive could be strong enough, especially if you paper and pencil!</p>
