Hi let us understand what is secrets and how to work with them. After creating
the pod there may be a requirement to use the credentials or some sensitive
informations sometimes the open authentication tokens or SSH keys
all this going to be very sensitive and the hard-coding it as a part of the pod or
having it as it is within the config map is going to be risky. So kubernetes provides
an option called secrets where the data will be encoded using the base 64 and
it will be stored within the secrets and we can protect the entire secrets using the
permissions and it's going to be more safe and secure and the data that is
getting encoded within the base 64 it can be decoded as well but directly the entire
text will not be logged anywhere or it's not going to get stored within the secrets.
Now let us go ahead and see a demo where I do have a couple of files
username and text. The secrets can be passed as a environmental variable to
the pod or it can be stored as a text file and use it as a part of the volume that is
getting mounted within the container. Now let me go ahead and create a couple
of files username.txt and password.txt within username.txt I do have a text
admin and within password.txt I do have a text, which is going to be some cryptic
password. I'm going to use these two files and create the secret.
In this introductory session we are going to create a secret of type genere and
there are different other types available to hold the certificates and for different
purpose that we will be seeing it as a part of advance discussion. I'm going to
use the kubectl create command, I'm going to create a secret this is going to
be the type and this is the name and I'm going to use the file username.txt and
password.txt So the secret got created let me go ahead and get the
secrets available. So I do have the secret with the name my secret and I can get
the details about this particular secret using the describe command
kubectl describe secrets and then the name of the secret. So I do have a secret
and it is having user name.txt which is of 5 bytes and password.txt of 13 bytes
I can get the details about the secret in the yaml format kubectl get secret name
of the secret and output as yaml file. Within that it's going to have the data that
is username.taxt and that will be used as a key and it is encoded using base64
As you all know decoding base64 is much easier I can go ahead and decode
this and show how it is going to look like. Let me copy the text that is available and
echo that using base64 decoding. So I am going to echo this particular content
pipe it to the the base64 code and decode them, so I have got the password
let me pass the username as well. So I'm going to echo this particular text pipe it
into base64 program and decode it, so I got the admin. So that means it is just
going to encode using base64 and store it as a part of the secrets, so that I am not
going to pass the actual text as it is it's going to get passed as the
encoded information. So instead of storing the content within a text file and
then passing them I can pass the literals as it is, for that I can use the
options --from-literal So I am going to use the kubectl create option provide
the name of the secret and I'm going to pass these two parameters where
I'm going to pass the key and value pair so here I am passing the key password
and the value corresponding to it and it is always recommended to encode the
password in a single quote, so that I don't need to escape the special
characters like amberson or back slash. The secret got created now I can get
more details about this particular secret using kubectl get command in the
yaml format. I can go ahead and decode in case if I wanted to get information
about this particular encoded text. The same way I can create a yaml file and
add the encoded text as a part of the yaml file and create the secret. Let me go
ahead and create a yaml file, I do have a yaml file, let me check the content of the
yaml file. So I do have the yaml file here I have added the username with base64
encoded, how did I get it ? I echoed the actual text and using the base64
program I got the encoded text. So here is the encoded text. So I have encoded
the actual text and added it as a part of the yaml file. Once the yaml file is ready
I can use the kubectl create command and provide the yaml file. As the secret
with the name my secret already existing, let me go ahead and delete the my secret
the one that we created using the literals, now I am going to use the yaml file and
create the secret. So kubectl create and then provide the file name so the my secret
should get created, now I can get the details about this particular my secret
using the get command, so I do have the key password and the user name and the
name of the secret is my secret. I can go ahead and use it within the pod. So let me
go ahead and create a pod and make use of this particular secret and see how it's
going to behave. Let me go ahead and create a pod so I do have a pod definition
I'm going to use the redis pod, within that I'm going to use a volume. Here I am
going to use the secret that is my secret, I'm going to use and that will get
mounted within /etc/secret folder within the container. So what we are going to do
we are going to mount the secrets as a part of the volume within the container.
Let me go ahead and create the pod the pod should get created, now I can get into
the pod using the pod name by providing exec command exec and then
name of the pod I'm going to execute the bash shell this will make the executable
to get executed in the interactive mode. I am into the pod. Here I am going to get
into the mount path that we had provided as a part of the pod definition.
that is /etc/secret here I do have the password and the username the text that
was provided as a part of the secret. So here I do have the password and here
I do have the username, so this was the username that was provided as a part of
the yaml file. So I can verify that by using the decode option. So this was
the yaml file which was used to create the secret. I can use the decode option
and see the username. So the admin was used as the username and as
a last option I am going to demonstrate how to use the secret as a part of the
environmental variable for the pod. For that I do have another yaml file, here
I'm going to pass the environmental variable where the name of the
environmental variable is secret_username within that I am
going to use the my secret and the key username and I can get into
the container and check whether these environmental variable has passed along
with the container or not when it was getting created. Let me go ahead and
create the pod. So I'm going to use kubectl apply and the name of
the yaml file the pod should get created. So this is the pod now I can get into the
pod using kubectl exec command, I am into the pod. Now I am going to get the
value of the environmental variable using echo statement, echo and then
dollar the environmental variable where I do have the username admin getting
printed the same way I can get the other environmental variable as well. I have got
the actual value. So we had seen the different ways how to create the secret
and how to make use of it along with the pod in terms of mounting it as a part of
the volume as well as passing it as a part of the environmental variables and
how the value is going to get encoded when the secret is getting created by
passing it as a literal or passing it as a part of the text file. Now let's go ahead
and clean this secrets that got created, so I'm going to use kubectl delete secret
and then the name of the secret. I can check whether all the secrets got
deleted or not I can use the command, so this is the default secret being used by
kubernetes so I will leave it as it is. So in a quick summary we had seen
how to create secrets and make use of it within the pods.