<p>I have been trying to port over some infrastructure to K8S from a VM docker setup. But I cannot seem to reference the tls certificate and key properly within the K8S <code>env.yaml</code> such that the container using the <code>env</code> can use them correctly.</p>
<p>In a traditional VM docker setup the <code>.env</code> file looks like this for referencing the tls cert+key:</p>
<pre><code>TLS_CERT_PATH=/tls/server.crt
TLS_KEY_PATH=/tls/server.key
</code></pre>
<p>In my K8S I create the tls cert+key via:</p>
<pre><code>kubectl create secret tls cl-tls --key &quot;server.key&quot; --cert &quot;server.crt&quot;
</code></pre>
<p>And I reference the tls cert+key via within the <code>env-configmap.yaml</code> via:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: env-config
data:
  TLS_CERT_PATH: &quot;cl-tls&quot;
  TLS_KEY_PATH: &quot;cl-tls&quot;
</code></pre>
<p>I have additionally tried with no luck either:</p>
<pre><code>kubectl create secret generic tls-cert --from-file=&quot;server.crt&quot;
kubectl create secret generic tls-key --from-file=&quot;server.key&quot;
</code></pre>
<p>With a <code>env-configmap.yaml</code>:</p>
<pre><code>TLS_CERT_PATH: &quot;tls-cert&quot;
TLS_KEY_PATH: &quot;tls-key&quot;
</code></pre>

Matt - Block-Farms.io
<p>You are mixing two different concepts.</p>
<ol>
<li>You want to make the <code>server.key</code> and <code>server.cert</code> files available to your pods, and want to reference them in your pod specification in the form of <code>PATH</code> variables. This is a separate implementation.       <em><strong>LEGACY APPROACH</strong></em></li>
<li>You want to convert the <code>server.key</code> and <code>server.cert</code> to a <code>secret</code> object. And you want to use the <code>secret</code> in your pods to inject the <code>server.key</code> and <code>server.cert</code> information directly in the pod. <em><strong>KUBERNETES NATIVE APPROACH</strong></em></li>
</ol>
<blockquote>
<p>Note: You do not need a <code>ConfigMap</code> in any case. (You should never use <code>ConfigMap</code> type for sensitive data anyway).</p>
</blockquote>
<h2>Procedure for Approach 1</h2>
<ol>
<li>Put the <code>server.cert</code> and <code>server.key</code> in a directory on the worker node where your pod will run. Let's call it <code>~/certs/</code>.</li>
<li>Mount this directory as a volume to your pods, with type <code>hostPath</code>. You can read more about them <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer">here</a>.</li>
<li>Add <code>TLS_CERT_PATH: &quot;~/.certs/server.cert&quot;</code> and <code>TLS_KEY_PATH: &quot;~/.certs/server.key&quot;</code> as environment variable to your pod. This will work as expected.</li>
</ol>
<p>This is it. You do not need config maps or secrets and this approach will work. This is not a recommended approach since if you want to rotate the certificates when they are about to expire, you'll have to manually update the <code>server.key</code> and <code>server.cert</code> files on your node for the pod authentication to work. But this is how it will be done.</p>
<h2>Procedure for Approach 2</h2>
<ol>
<li>Create a <code>tls</code> type secret with your <code>server.cert</code> and <code>server.key</code> files. (You're already doing this correctly). You can use <a href="https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets" rel="nofollow noreferrer">this doc</a> for more details.</li>
<li>Use that secret to inject the <code>server.cert</code> and <code>server.key</code> into your pods. You will mount this secret as a volume to your pod. And then you can reference the secret parameters as &quot;files&quot; in your pod specification. When secrets are used in this way the parameter name becomes a file at the mount point, and the parameter value becomes the contents of that file. You'll configure your pod specification with environment as <code>TLS_CERT_PATH: &quot;secret/mount/path/server.cert&quot;</code> and <code>TLS_KEY_PATH:&quot;secret/mount/path/server.key&quot;</code>. You can find the recipe to do that in the docs <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="nofollow noreferrer">here</a>.</li>
</ol>
<p>Both approaches will work. Except this time, you can very easily rotate your TLS certificates by simply updating the <code>Secret</code> object and the volume mount sync will automatically update it in all the pods that have it mounted. Understand that secrets are functionally equivalent to <code>ConfigMaps</code>. Both are key/value pairs. It is just that <code>Secrets</code> have special attributes and features that make them more suitable to be used for sensitive data.</p>
<p>Hope this helps!</p>
