Using a Kubernetes Secret with a Configuration Variables Template

A Kubernetes Secret is an object that contains a small piece of confidential data such as credentials. The Secret is separate from a Docker container image, meaning the confidential data can be externalized. You can use a Kubernetes Secret with Microservices Runtime by specifying the key for the Secret in the configuration variables file that is passed into a Microservices Runtime running in a Docker container.

Microservices Runtime supports one Secret per container (each Secret can contain multiple entries often called keys) and a Secret of type Opaque only.

Prior to using a Secret with a configuration variables files (application.properties), you must do the following:

To use a Kubernetes Secret for a property value in a configuration variables file, set the key-value pair for the asset property using the following format:

key=$secret{SecretName}

Where the SecretName is the key for the secret whose value you want to use. For example:

truststore.DEFAULT_JVM_TRUSTSTORE.ksPassword=$secret{TruststorePasswordSecretName}

user.userName.password=$secret{mySecretPassword}

When you start the container, you can set the SECRET_PATH environment variable to the path where the Secret will be present inside the container. You do not need to specify this environment variable if the Secret is mounted at /etc/secrets.

When Microservices Runtime applies the configuration variables file, Microservices Runtime looks for the location of the Secret by first checking if the SECRET_PATH environment variable is present. If so, then Microservices Runtime reads the Secret from the path present in this environment variable. If the SECRET_PATH environment variable was not provided when the container started, then Microservices Runtime expects the Secret will be mounted at /etc/secrets and will read the Secret from there.

If Microservices Runtime cannot find the Secret used in the configuration variables file (the Secret is not present or access to the file is restricted due to file permissions), the following Info level message will be written to the configurationvariables.log: