<p>I am trying to generate a Kubernetes secret from a Kubernetes job. The secret is a TLS certificate, for elasticsearch transport, I tried this job:</p>

<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: conso-security-tls-gen-certs
spec:
  template:
    spec:
      containers:
      - name: generator
        volumeMounts:
          - name: certs
            mountPath: "/certs"
        image: "docker.elastic.co/elasticsearch/elasticsearch:7.4.2"
        command: ["/bin/sh", "-c"]
        args:
        - "bin/elasticsearch-certutil ca (...) --silent -out /certs/bundle.p12"
      restartPolicy: Never
      volumes:
      - name: certs
        secret:
          secretName: conso-security-tls-certs
  backoffLimit: 4
</code></pre>

<p>But as <a href="https://github.com/kubernetes/kubernetes/issues/62099" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/62099</a> said, the volume <code>/certs</code> is ReadOnly. Is there a way to create/edit this secret like this?</p>

Thomas Decaux
<p><a href="https://kubernetes.io/docs/concepts/storage/volumes/#secret" rel="nofollow noreferrer">Volumes from secrets</a> are gone once the container/pod is gone. Also, updating files in volumes created from a Secret will not update the Secret itself.</p>

<p>It seems that what the goal is from the Job to generate a cert and create or update a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a> object with that cert? If that is the case I'd suggest looking into using the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.16/#secret-v1-core" rel="nofollow noreferrer">Kubernetes API</a> or <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands" rel="nofollow noreferrer"><code>kubectl</code></a> to manipulate Secrets from within the running container. You'd need to set up and use a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Service Account</a> that has permission to work with Secrets in the given namespace.</p>
