Pod with Sensitive Information

Sensitive information, for example passwords, should be managed with special care. Volumes that store sensitive information are called Secret and are similar to ConfigMap.

Creating secret with podman kube

New secret can be created by running

podman kube play secret.yml

where secret.yml is a Kubernetes manifest file like

apiVersion: v1
kind: Secret
metadata:
    name: password
stringData:
    password: 123456

Danger

Sensitive information must ALWAYS be encrypted when stored in a file. In other words, NEVER store your secret.yml.

Danger

Sensitive information must NEVER be stored in your shell history. ALWAYS prepend the command with a white space to avoid the command to be recorded on the shell history.

Creating secret with podman secret

New secret can be created by running

podman secret create password secret.yml

where secret.yml is a Kubernetes manifest file like

apiVersion: v1
kind: Secret
metadata:
    name: password
stringData:
    password: 123456

Important

The secret must be a Kubernetes manifest because it will be parse when the pod is created.

Danger

Sensitive information must ALWAYS be encrypted when stored in a file. In other words, NEVER store your secret.yml.

Danger

Sensitive information must NEVER be stored in your shell history. ALWAYS prepend the command with a white space to avoid the command to be recorded on the shell history.

Using secret

After creation, Secret can be referenced by another Kubernetes manifest file like

apiVersion: v1
kind: Pod
metadata:
    ...
spec:
    containers:
        - volumeMounts:
            - mountPath: /path/to/dir
              name: password-volume
    volumes:
        - secret:
            secretName: password
          name: password-volume

Each key in stringData will be one file in mountPath.

Example

Given the following Kubernetes manifest file

secret.yml
apiVersion: v1
kind: Secret
metadata:
  name: html
stringData:
  index.html: |
    <!DOCTYPE html>
    <html>
        <body>
            <p>This is a secret.</p>
        </body>
    </html>

running

podman kube play secret.yml

creates a Secret named html.

Given the following Kubernetes manifest file

play.yml
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: nginx-secret0
  name: nginx-secret0
spec:
  containers:
  - args:
    - nginx
    - -g
    - daemon off;
    image: docker.io/library/nginx:alpine
    name: nginx
    ports:
    - containerPort: 80
      hostPort: 8080
    volumeMounts:
    - mountPath: /usr/share/nginx/html
      name: nginx-secret
  volumes:
  - secret:
      # Provide the name of the ConfigMap you want to mount.
      secretName: html
    name: nginx-secret

running

podman kube play play.yml

creates a pod named nginx-secret0 with

  • a container named nginx running the image docker.io/library/nginx:alpine,

  • the port 8080 in the host is mapped to the port 80 in the container,

  • the Secret html mounted in /usr/share/nginx/html.

The NGINX server can be tested with

curl http://localhost:8080

that is expected to return

<!DOCTYPE html>
<html>
    <body>
        <p>This is a secret.</p>
    </body>
</html>

Further reading