<p>I use an Kubernetes Init container to provision the application's database. After this is done I want to provide the DB's credentials to the main container via environment variables.</p>
<p>How can this be achieved?</p>
<p>I don't want to create a Kubernetes Secret inside the Init container, since I don't want to save the credentials there!</p>

vuza
<p>I see several ways to achieve what you want:</p>

<ol>
<li><p>From my perspective, the best way is to use Kubernetes Secret. @Nebril has already provided that idea in the comments. You can generate it by Init Container and remove it by <a href="https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/#define-poststart-and-prestop-handlers" rel="noreferrer">PreStop</a> hook, for example. But, you don't want to go that way. </p></li>
<li><p>You can use a shared volume which will be used by InitConatainer and your main pod. InitContainer will generate the environment variables file <code>db_cred.env</code> in the volume which you can mount, for example, to <code>/env</code> path. After that, you can load it by modifying a <code>command</code> of your container in the Pod spec and add the command <code>source /env/db_cred.env</code> before the main script which will start your application. @user2612030 already gave you that idea.</p></li>
<li><p>Another alternative way can be <a href="https://www.vaultproject.io/" rel="noreferrer">Vault</a> by Hashicorp, you can use it as storage of all your credentials.</p></li>
<li><p>You can use some custom solution to write and read directly to Etcd from Kubernetes apps. Here is a library example - <a href="https://github.com/rusenask/k8s-kv" rel="noreferrer">k8s-kv</a>.</p></li>
</ol>

<p>But anyway, the best and the most proper way to store credentials in Kubernetes is Secrets. It is more secure and easier than almost any other way.</p>
