<p>I am new to kubernetes and trying to add root certs to my existing secrets truststore.jks file. Using <code>get secret mysecret -o yaml</code>. I am able to view the details of truststore file inside mysecret but not sure how to replace with new truststore file or to edit the existing one with latest root certs. Can anyone help me to get the correct command to do this using kubectl?</p>

<p>Thanks</p>

Anshu
<p>A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. There is an official documentation about <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Kubernetes.io: Secrets</a>.</p>

<p>Assuming that you created your secret by: </p>

<p><code>$ kubectl create secret generic NAME_OF_SECRET --from-file=keystore.jks</code></p>

<p>You can edit your secret by invoking command: </p>

<p><code>$ kubectl edit secret NAME_OF_SECRET</code></p>

<p>It will show you <code>YAML</code> definition similar to this: </p>

<pre><code>apiVersion: v1
data:
  keystore.jks: HERE_IS_YOUR_JKS_FILE
kind: Secret
metadata:
  creationTimestamp: "2020-02-20T13:14:24Z"
  name: NAME_OF_SECRET
  namespace: default
  resourceVersion: "430816"
  selfLink: /api/v1/namespaces/default/secrets/jks-old
  uid: 0ce898af-8678-498e-963d-f1537a2ac0c6
type: Opaque
</code></pre>

<p>To change it to new <code>keystore.jks</code> you would need to base64 encode it and paste in place of old one (<code>HERE_IS_YOUR_JKS_FILE</code>)</p>

<p>You can get a base64 encoded string by: 
<code>cat keystore.jks | base64</code></p>

<p>After successfully editing your secret it should give you a message: 
<code>secret/NAME_OF_SECRET edited</code></p>

<hr>

<p>Also you can look on this <a href="https://stackoverflow.com/a/38216458/12257134">StackOverflow answer</a> </p>

<p>It shows a way to replace existing configmap but with a little of modification it can also replace a secret! </p>

<p>Example below:</p>

<ul>
<li><p>Create a secret with keystore-old.jks: </p>

<p><code>$ kubectl create secret generic my-secret --from-file=keystore-old.jks</code></p></li>
<li><p>Update it with keystore-new.jks:</p>

<p><code>$ kubectl create secret generic my-secret --from-file=keystore-new.jks -o yaml --dry-run | kubectl replace -f -</code></p></li>
</ul>

<hr>

<p>Treating <code>keystore.jks</code> as a file allows you to use a volume mount to mount it to specific location inside a pod. </p>

<p>Example <code>YAML</code> below creates a pod with secret mounted as volume: </p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: ubuntu
spec:
  containers:
  - name: ubuntu
    image: ubuntu
    command:
      - sleep
      - "360000"
    volumeMounts:
    - name: secret-volume
      mountPath: "/etc/secret"
  volumes:
  - name: secret-volume
    secret:
      secretName: NAME_OF_SECRET
</code></pre>

<p>Take a specific look on: </p>

<pre><code>    volumeMounts:
    - name: secret-volume
      mountPath: "/etc/secret"
  volumes:
  - name: secret-volume
    secret:
      secretName: NAME_OF_SECRET
</code></pre>

<p>This part will mount your secret inside your /etc/secret/ directory. It will be available there with a name <code>keystore.jks</code></p>

<p>A word about mounted secrets: </p>

<blockquote>
  <h2>Mounted Secrets are updated automatically<a href="https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically" rel="nofollow noreferrer"></a></h2>
  
  <p>When a secret currently consumed in a volume is updated, projected keys are eventually updated as well. The kubelet checks whether the mounted secret is fresh on every periodic sync.</p>
  
  <p>--  <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Kubernetes.io: Secrets</a>.
    </p>
</blockquote>

<p>Please let me know if you have any questions regarding that.</p>
