<p>My overall goal is to create MySQL users (despite <code>root</code>) automatically after the deployment in Kubernetes.</p>
<p>I found the following resources:<br />
<a href="https://stackoverflow.com/questions/64946194/how-to-create-mysql-users-and-database-during-deployment-of-mysql-in-kubernetes">How to create mysql users and database during deployment of mysql in kubernetes?</a><br />
<a href="https://stackoverflow.com/questions/50373869/add-another-user-to-mysql-in-kubernetes">Add another user to MySQL in Kubernetes</a></p>
<p>People suggested that <code>.sql</code> scripts can be mounted to <code>docker-entrypoint-initdb.d</code> with a ConfigMap to create these users. In order to do that, I have to put the password of these users in this script in plain text. This is a potential security issue. Thus, I want to store MySQL usernames and passwords as Kubernetes Secrets.</p>
<p>This is my ConfigMap</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: mysql-config
  labels:
    app: mysql-image-db
data:
  initdb.sql: |-
    CREATE USER &lt;user&gt;@'%' IDENTIFIED BY &lt;password&gt;;
</code></pre>
<p>How can I access the associated Kubernetes secrets within this ConfigMap?</p>

Marcel Gohsen
<p>I am finally able to provide a solution to my own question. Since PjoterS made me aware that you can mount Secrets into a Pod as a volume, I came up with following solution.</p>
<p>This is the ConfigMap for the user creation scipt:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: mysql-init-script
  labels:
    app: mysql-image-db
data:
  init-user.sh: |-
    #!/bin/bash
    sleep 30s

    mysql -u root -p&quot;$(cat /etc/mysql/credentials/root_password)&quot; -e \
      &quot;CREATE USER '$(cat /etc/mysql/credentials/user_1)'@'%' IDENTIFIED BY '$(cat /etc/mysql/credentials/password_1)';&quot;
</code></pre>
<p>To made this work, I needed to mount the ConfigMap and the Secret as Volumes of my Deployment and added a <code>postStart</code> lifecycle hook to execute the user creation script.</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql-image-db
spec:
  selector:
    matchLabels:
      app: mysql-image-db
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: mysql-image-db
    spec:
      containers:
        - image: mysql:8.0
          name: mysql
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: root_password
                  name: mysql-user-credentials
          ports:
            - containerPort: 3306
              name: mysql
          volumeMounts:
            - name: mysql-persistent-volume
              mountPath: /var/lib/mysql
            - name: mysql-config-volume
              mountPath: /etc/mysql/conf.d
            - name: mysql-init-script-volume
              mountPath: /etc/mysql/init
            - name: mysql-credentials-volume
              mountPath: /etc/mysql/credentials
          lifecycle:
            postStart:
              exec:
                command: [&quot;/bin/bash&quot;, &quot;-c&quot;, &quot;/etc/mysql/init/init-user.sh&quot;]
      volumes:
        - name: mysql-persistent-volume
          persistentVolumeClaim:
            claimName: mysql-volume-claim
        - name: mysql-config-volume
          configMap:
            name: mysql-config
        - name: mysql-init-script-volume
          configMap:
            name: mysql-init-script
            defaultMode: 0777
        - name: mysql-credentials-volume
          secret:
            secretName: mysql-user-credentials
</code></pre>
