Skip to content

Commit 5bfb353

Browse files
committed
Convert env variables use case and SSH key use case into bullets with links
- Link to the actual task topics - Remove the list of uses for secrets that link to anchors on page and replace with links to tasks
1 parent f09e80a commit 5bfb353

File tree

1 file changed

+4
-71
lines changed
  • content/en/docs/concepts/configuration

1 file changed

+4
-71
lines changed

content/en/docs/concepts/configuration/secret.md

Lines changed: 4 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -55,83 +55,16 @@ See [Information security for Secrets](#information-security-for-secrets) for mo
5555

5656
## Uses for Secrets
5757

58-
There are three main ways for a Pod to use a Secret:
58+
You can use Secrets for purposes such as the following:
5959

60-
- As [files](#using-secrets-as-files-from-a-pod) in a
61-
{{< glossary_tooltip text="volume" term_id="volume" >}} mounted on one or more of
62-
its containers.
63-
- As [container environment variable](#using-secrets-as-environment-variables).
64-
- By the [kubelet when pulling images](#using-imagepullsecrets) for the Pod.
60+
- [Set environment variables for a container](/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
61+
- [Provide credentials such as SSH keys or passwords to Pods](/docs/tasks/inject-data-application/distribute-credentials-secure/#provide-prod-test-creds).
62+
- [Allow the kubelet to pull container images from private registries](/docs/tasks/configure-pod-container/pull-image-private-registry/).
6563

6664
The Kubernetes control plane also uses Secrets; for example,
6765
[bootstrap token Secrets](#bootstrap-token-secrets) are a mechanism to
6866
help automate node registration.
6967

70-
## Use cases
71-
72-
### Use case: As container environment variables {#use-case-as-container-environment-variables}
73-
74-
You can create a Secret and use it to
75-
[set environment variables for a container](/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data).
76-
77-
### Use case: Pod with SSH keys
78-
79-
Create a Secret containing some SSH keys:
80-
81-
```shell
82-
kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
83-
```
84-
85-
The output is similar to:
86-
87-
```
88-
secret "ssh-key-secret" created
89-
```
90-
91-
You can also create a `kustomization.yaml` with a `secretGenerator` field containing ssh keys.
92-
93-
{{< caution >}}
94-
Think carefully before sending your own SSH keys: other users of the cluster may have access
95-
to the Secret.
96-
97-
You could instead create an SSH private key representing a service identity that you want to be
98-
accessible to all the users with whom you share the Kubernetes cluster, and that you can revoke
99-
if the credentials are compromised.
100-
{{< /caution >}}
101-
102-
Now you can create a Pod which references the secret with the SSH key and
103-
consumes it in a volume:
104-
105-
```yaml
106-
apiVersion: v1
107-
kind: Pod
108-
metadata:
109-
name: secret-test-pod
110-
labels:
111-
name: secret-test
112-
spec:
113-
volumes:
114-
- name: secret-volume
115-
secret:
116-
secretName: ssh-key-secret
117-
containers:
118-
- name: ssh-test-container
119-
image: mySshImage
120-
volumeMounts:
121-
- name: secret-volume
122-
readOnly: true
123-
mountPath: "/etc/secret-volume"
124-
```
125-
126-
When the container's command runs, the pieces of the key will be available in:
127-
128-
```
129-
/etc/secret-volume/ssh-publickey
130-
/etc/secret-volume/ssh-privatekey
131-
```
132-
133-
The container is then free to use the secret data to establish an SSH connection.
134-
13568
### Use case: Pods with prod / test credentials
13669

13770
This example illustrates a Pod which consumes a secret containing production credentials and

0 commit comments

Comments
 (0)