<p>I'm deploying a service which rigidly takes a YAML config that looks something like this:</p>

<pre><code># /config/srv.yaml

#
# ...
#
tenantid: '...'
clientid: '...'
certfile: '/config/client/client.crt'
keyfile:  '/config/client/client.key'
#
# ...
#
</code></pre>

<p>TL;DR; I want to <em>only</em> store the <code>tenantid</code>, <code>clientid</code> &amp; cert files in <code>k8s</code> secrets.</p>

<p>My current solution, stores the entire YAML file in secrets, which seems wasteful and also cumbersome to manage.</p>

<hr>

<p>Essentially I have this - which works well for the 2 cert files (<code>/config/client/client.crt</code> and <code>/config/client/client.key</code>):</p>

<pre><code>spec:
  containers:
    - name: my-container
      image: "my-image"
      imagePullPolicy: Always
      ports:
        - containerPort: 50100
      env:
      - name: CONF_FILE
        value: "/config/srv.yaml"
      volumeMounts:
      - name: yaml-vol
        mountPath: "/config" # KLUDGY
        readOnly: true
      - name: certs-vol
        mountPath: "/config/client"
        readOnly: true

    volumes:
    - name: yaml-vol
      secret:
        secretName: my-yamls # KLUDGY
    - name: certs-vol
      secret:
        secretName: my-certs # contains the *.crt/*.key cert files
</code></pre>

<p>However it involves storing the entire <code>/config/srv.yaml</code> in the kubernetes secrets <code>my-yamls</code>.</p>

<p>The <a href="https://kubernetes.io/docs/concepts/configuration/secret/#creating-a-secret-manually" rel="nofollow noreferrer">k8s secrets docs</a> suggest there's a way to create a dynamic YAML config for one's containers -  filling in the secrets precisely where needed, using <code>stringData</code> e.g.</p>

<pre><code>stringData:
  config.yaml: |-
    apiUrl: "https://my.api.com/api/v1"
    username: {{username}}
    password: {{password}}
</code></pre>

<p>but the docs trail off with a very vague:</p>

<blockquote>
  <p>Your deployment tool could then replace the {{username}} and
  {{password}} template variables before running <code>kubectl apply</code>.</p>
</blockquote>

<p>I just need to fill in two string items in a dynamic config: <code>clientid</code> and <code>tenantid</code>.</p>

<p>Using just <code>kubectl</code>, how can one create a dynamic YAML for a container - storing the non-sensitive YAML template in the <code>deploy.yaml</code> - and have just the sensitive items in <code>k8s secrets</code>?</p>

colm.anseo
<p>An alternative will be to use another tool for secret management. One solution will be to use <a href="https://kamus.soluto.io" rel="nofollow noreferrer">Kamus</a>. Kamus support <a href="https://github.com/Soluto/kamus/tree/master/init-container" rel="nofollow noreferrer">templating</a> so you can do something like:</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: encrypted-secrets-cm
data:
  tenantid: &lt;encrypted&gt;
  clientid: &lt;encrypted&gt;
  template.ejs: |
     tenantid: &lt;%- secrets["tenantid"] %&gt;
     clientid: &lt;%- secrets["clientid"] %&gt;
     certfile: '/config/client/client.crt'
     keyfile:  '/config/client/client.key'
</code></pre>

<p>Where the values are encrypted using Kamus.</p>

<p>And then either use clientSecret and store it the same way, or create a regular secret for both the crt and key. It's worth noticing that (assuming this is Azure) client id and tenant id are not considered secrets, and can be committed to a private repository.</p>

<p>Full disclosure: I'm Kamus author.</p>
