<p>For now, I deploy my application pods using static files and one of them is <code>app-secrets.yaml</code> with all secrets to deploy an application</p>

<pre><code>---
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  root: xxxxxx
  user1: xxxxxx
  user2: xxxxxx
</code></pre>

<p>but this is not neither secure nor convenient (if I need another app instance, I have to create another file with human-generated password).</p>

<p>I'm looking to generate random passwords at application creation but I don't know if it's possible.
I've already looked to the topic <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">secret</a> and especially <code>secretGenerator</code> but this is not directly what I want as I understand it, because it does not create a random string but a random secret name like <code>secret/app-secrets-ssdsdfmfh4k</code> but I have to provide still the passwords.</p>

Baptiste Mille-Mathias
<p>You may want to use <a href="https://github.com/mittwald/kubernetes-secret-generator" rel="nofollow noreferrer">kubernetes-secret-generator</a>. I've tested it and it's doing exactly what you need.</p>
<p>To accomplish it you have to have helm in your cluster and follow these instructions:</p>
<p>Clone repository</p>
<pre><code>$ git clone https://github.com/mittwald/kubernetes-secret-generator
</code></pre>
<p>Create helm deployment</p>
<pre><code>$ helm upgrade --install secret-generator ./deploy/chart
</code></pre>
<p>Now you to use it, you just have to</p>
<blockquote>
<p>Add annotation <code>secret-generator.v1.mittwald.de/autogenerate</code> to any
Kubernetes secret object .The value of the annotation can be a field
name (or comma separated list of field names) within the secret; the
SecretGeneratorController will pick up this annotation and add a field
[or fields] (<code>password</code> in the example below) to the secret with a
randomly generated string value. From <a href="https://github.com/mittwald/kubernetes-secret-generator#usage" rel="nofollow noreferrer">here</a>.</p>
</blockquote>
<pre><code>$ kubectl apply -f mysecret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
  annotations:
    secret-generator.v1.mittwald.de/autogenerate: password
data:
  username: UGxlYXNlQWNjZXB0Cg==
</code></pre>
<p>After applying this secret you can take a look at it to check if the passward was generated as expected:</p>
<pre><code>$ kubectl get secrets mysecret -o yaml
apiVersion: v1
data:
  password: dnVKTDBJZ0tFS1BacmtTMnBuc3d2YWs2YlZsZ0xPTUFKdStDa3dwUQ==
  username: UGxlYXNlQWNjZXB0Cg==
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;data&quot;:{&quot;username&quot;:&quot;UGxlYXNlQWNjZXB0Cg==&quot;},&quot;kind&quot;:&quot;Secret&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;secret-generator.v1.mittwald.de/autogenerate&quot;:&quot;password&quot;},&quot;name&quot;:&quot;mysecret&quot;,&quot;namespace&quot;:&quot;default&quot;}}
    secret-generator.v1.mittwald.de/autogenerate: password
    secret-generator.v1.mittwald.de/autogenerate-generated-at: 2020-01-09 14:29:44.397648062
      +0000 UTC m=+664.011602557
    secret-generator.v1.mittwald.de/secure: &quot;yes&quot;
  creationTimestamp: &quot;2020-01-09T14:29:44Z&quot;
  name: mysecret
  namespace: default
  resourceVersion: &quot;297425&quot;
  selfLink: /api/v1/namespaces/default/secrets/mysecret
  uid: 7ae42d71-32ec-11ea-92b3-42010a800009
type: Opaque
</code></pre>
<p>As we can see, the password was generated.</p>
