<p>We are working on a Java Spring Boot application, that needs access to a database, the password is stored on the <code>application.properties</code> file.</p>
<p>Our main issue is that the passwords might be viewable when uploaded to GitLab/GitHub.</p>
<p>I found that we can use Jasypt to encrypt the data, but from what I read, I need to use the decryption key on the execution, which is also stored on Git, in order to be deployed using Kubernates.</p>
<p>Is there some way to secure our passwords in such a case? We are using AWS if that makes any difference, and we are trying to use the EKS service, but until now we have had a VM with K8s installed.</p>

Skaros Ilias
<p>You should use environment variables in your <code>application.properties</code> file for this:</p>
<pre><code>spring.datasource.username=${SPRING_DATASOURCE_USERNAME}
spring.datasource.password=${SPRING_DATASOURCE_PASSWORD}
</code></pre>
<p>Or with a default value (for development):</p>
<pre><code>spring.datasource.username=${SPRING_DATASOURCE_USERNAME:admin}
spring.datasource.password=${SPRING_DATASOURCE_PASSWORD:admin}
</code></pre>
<p>Then you can add a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">Kubernetes Secret</a> to your namespace:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
  namespace: mynamespace
data:
  SPRING_DATASOURCE_PASSWORD: YWRtaW4=
  SPRING_DATASOURCE_USERNAME: YWRtaW4=
</code></pre>
<p>And assign it to your Deployment:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: mydeployment
spec:
  # omitted...
      containers:
      - name: mycontainer
        envFrom:
        - secretRef:
            name: mysecret
        - configMapRef:
            name: myconfigmap
  # omitted...
</code></pre>
<p>Another alternative would be to store the entire <code>application.properties</code> file in your Secret or ConfigMap and <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="noreferrer">mount it into your container as a file</a>.</p>
<p>Both scenarios are explained in further detail here:
<a href="https://developers.redhat.com/blog/2017/10/03/configuring-spring-boot-kubernetes-configmap" rel="noreferrer">https://developers.redhat.com/blog/2017/10/03/configuring-spring-boot-kubernetes-configmap</a></p>
