Skip to content

Commit 37a8a5a

Browse files
committed
Clean up distribute-credentials-secure.md
1 parent 00c9013 commit 37a8a5a

File tree

1 file changed

+83
-66
lines changed

1 file changed

+83
-66
lines changed

content/en/docs/tasks/inject-data-application/distribute-credentials-secure.md

Lines changed: 83 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -112,12 +112,14 @@ Here is a configuration file you can use to create a Pod:
112112
```
113113

114114
Output:
115+
115116
```
116117
NAME READY STATUS RESTARTS AGE
117118
secret-test-pod 1/1 Running 0 42m
118119
```
119120

120121
1. Get a shell into the Container that is running in your Pod:
122+
121123
```shell
122124
kubectl exec -i -t secret-test-pod -- /bin/bash
123125
```
@@ -126,22 +128,28 @@ Here is a configuration file you can use to create a Pod:
126128
`/etc/secret-volume`.
127129

128130
In your shell, list the files in the `/etc/secret-volume` directory:
131+
129132
```shell
130133
# Run this in the shell inside the container
131134
ls /etc/secret-volume
132135
```
136+
133137
The output shows two files, one for each piece of secret data:
138+
134139
```
135140
password username
136141
```
137142

138143
1. In your shell, display the contents of the `username` and `password` files:
144+
139145
```shell
140146
# Run this in the shell inside the container
141147
echo "$( cat /etc/secret-volume/username )"
142148
echo "$( cat /etc/secret-volume/password )"
143149
```
150+
144151
The output is your username and password:
152+
145153
```
146154
my-app
147155
39528$vdg7Jb
@@ -153,8 +161,8 @@ in this directory.
153161

154162
### Project Secret keys to specific file paths
155163

156-
You can also control the paths within the volume where Secret keys are projected. Use the `.spec.volumes[].secret.items` field to change the target
157-
path of each key:
164+
You can also control the paths within the volume where Secret keys are projected. Use the
165+
`.spec.volumes[].secret.items` field to change the target path of each key:
158166

159167
```yaml
160168
apiVersion: v1
@@ -260,13 +268,14 @@ secrets change.
260268
kubectl create -f https://k8s.io/examples/pods/inject/pod-single-secret-env-variable.yaml
261269
```
262270

263-
- In your shell, display the content of `SECRET_USERNAME` container environment variable
271+
- In your shell, display the content of `SECRET_USERNAME` container environment variable.
264272

265273
```shell
266274
kubectl exec -i -t env-single-secret -- /bin/sh -c 'echo $SECRET_USERNAME'
267275
```
268276

269-
The output is
277+
The output is similar to:
278+
270279
```
271280
backend-admin
272281
```
@@ -290,12 +299,14 @@ secrets change.
290299
kubectl create -f https://k8s.io/examples/pods/inject/pod-multiple-secret-env-variable.yaml
291300
```
292301

293-
- In your shell, display the container environment variables
302+
- In your shell, display the container environment variables.
294303

295304
```shell
296305
kubectl exec -i -t envvars-multiple-secrets -- /bin/sh -c 'env | grep _USERNAME'
297306
```
298-
The output is
307+
308+
The output is similar to:
309+
299310
```
300311
DB_USERNAME=db-admin
301312
BACKEND_USERNAME=backend-admin
@@ -313,7 +324,8 @@ This functionality is available in Kubernetes v1.6 and later.
313324
kubectl create secret generic test-secret --from-literal=username='my-app' --from-literal=password='39528$vdg7Jb'
314325
```
315326

316-
- Use envFrom to define all of the Secret's data as container environment variables. The key from the Secret becomes the environment variable name in the Pod.
327+
- Use envFrom to define all of the Secret's data as container environment variables.
328+
The key from the Secret becomes the environment variable name in the Pod.
317329

318330
{{% code file="pods/inject/pod-secret-envFrom.yaml" %}}
319331

@@ -323,13 +335,14 @@ This functionality is available in Kubernetes v1.6 and later.
323335
kubectl create -f https://k8s.io/examples/pods/inject/pod-secret-envFrom.yaml
324336
```
325337

326-
- In your shell, display `username` and `password` container environment variables
338+
- In your shell, display `username` and `password` container environment variables.
327339

328340
```shell
329341
kubectl exec -i -t envfrom-secret -- /bin/sh -c 'echo "username: $username\npassword: $password\n"'
330342
```
331343

332-
The output is
344+
The output is similar to:
345+
333346
```
334347
username: my-app
335348
password: 39528$vdg7Jb
@@ -364,72 +377,76 @@ another Pod which consumes a secret with test environment credentials.
364377
secret "test-db-secret" created
365378
```
366379

367-
{{< note >}}
368-
Special characters such as `$`, `\`, `*`, `=`, and `!` will be interpreted by your
369-
[shell](https://en.wikipedia.org/wiki/Shell_(computing)) and require escaping.
380+
{{< note >}}
381+
Special characters such as `$`, `\`, `*`, `=`, and `!` will be interpreted by your
382+
[shell](https://en.wikipedia.org/wiki/Shell_(computing)) and require escaping.
370383

371-
In most shells, the easiest way to escape the password is to surround it with single quotes (`'`).
372-
For example, if your actual password is `S!B\*d$zDsb=`, you should execute the command as follows:
384+
In most shells, the easiest way to escape the password is to surround it with single quotes (`'`).
385+
For example, if your actual password is `S!B\*d$zDsb=`, you should execute the command as follows:
373386

374-
```shell
375-
kubectl create secret generic dev-db-secret --from-literal=username=devuser --from-literal=password='S!B\*d$zDsb='
376-
```
387+
```shell
388+
kubectl create secret generic dev-db-secret --from-literal=username=devuser --from-literal=password='S!B\*d$zDsb='
389+
```
377390

378-
You do not need to escape special characters in passwords from files (`--from-file`).
379-
{{< /note >}}
391+
You do not need to escape special characters in passwords from files (`--from-file`).
392+
{{< /note >}}
380393

381394
1. Create the Pod manifests:
382395

383-
```shell
384-
cat <<EOF > pod.yaml
385-
apiVersion: v1
386-
kind: List
387-
items:
388-
- kind: Pod
389-
apiVersion: v1
390-
metadata:
391-
name: prod-db-client-pod
392-
labels:
393-
name: prod-db-client
394-
spec:
395-
volumes:
396-
- name: secret-volume
397-
secret:
398-
secretName: prod-db-secret
399-
containers:
400-
- name: db-client-container
401-
image: myClientImage
402-
volumeMounts:
403-
- name: secret-volume
404-
readOnly: true
405-
mountPath: "/etc/secret-volume"
406-
- kind: Pod
407-
apiVersion: v1
408-
metadata:
409-
name: test-db-client-pod
410-
labels:
411-
name: test-db-client
412-
spec:
413-
volumes:
414-
- name: secret-volume
415-
secret:
416-
secretName: test-db-secret
417-
containers:
418-
- name: db-client-container
419-
image: myClientImage
420-
volumeMounts:
421-
- name: secret-volume
422-
readOnly: true
423-
mountPath: "/etc/secret-volume"
424-
EOF
425-
```
426-
Note how the specs for the two Pods differ only in one field; this facilitates creating Pods with different capabilities from a common Pod template.
396+
```shell
397+
cat <<EOF > pod.yaml
398+
apiVersion: v1
399+
kind: List
400+
items:
401+
- kind: Pod
402+
apiVersion: v1
403+
metadata:
404+
name: prod-db-client-pod
405+
labels:
406+
name: prod-db-client
407+
spec:
408+
volumes:
409+
- name: secret-volume
410+
secret:
411+
secretName: prod-db-secret
412+
containers:
413+
- name: db-client-container
414+
image: myClientImage
415+
volumeMounts:
416+
- name: secret-volume
417+
readOnly: true
418+
mountPath: "/etc/secret-volume"
419+
- kind: Pod
420+
apiVersion: v1
421+
metadata:
422+
name: test-db-client-pod
423+
labels:
424+
name: test-db-client
425+
spec:
426+
volumes:
427+
- name: secret-volume
428+
secret:
429+
secretName: test-db-secret
430+
containers:
431+
- name: db-client-container
432+
image: myClientImage
433+
volumeMounts:
434+
- name: secret-volume
435+
readOnly: true
436+
mountPath: "/etc/secret-volume"
437+
EOF
438+
```
439+
440+
{{< note >}}
441+
How the specs for the two Pods differ only in one field; this facilitates creating Pods
442+
with different capabilities from a common Pod template.
443+
{{< /note >}}
427444
428445
1. Apply all those objects on the API server by running:
429446
430-
```shell
431-
kubectl create -f pod.yaml
432-
```
447+
```shell
448+
kubectl create -f pod.yaml
449+
```
433450
434451
Both containers will have the following files present on their filesystems with the values
435452
for each container's environment:

0 commit comments

Comments
 (0)