Phoenix Cloud Shared Secrets

Creating Secrets

See OpenShift: Providing sensitive data to pods

oc -n "${NAMESPACE}" delete secret "${SECRET_NAME}"
oc -n "${NAMESPACE}" create secret generic "${SECRET_NAME}" --from-env-file="secrets/${SECRET_NAME}.env"

NOTE: Deploying secrets will not affect running Pods. They need to be restarted or redeployed to pull any changed configuration.

Usage Examples

The following examples explain their behavior with my-first-secret hosting

ALPHA="earth"
BRAVO="mars"

and my-second-secret hosting

BRAVO="saturn"
CHARLIE="neptune"

Importing the whole Secret

See EnvFromSource and SecretEnvSource

Using envFrom and secretRef we can conveniently import the whole Secret:

kind: DeploymentConfig
apiVersion: v1
spec:
  template:
    spec:
      containers:
      - name: my-container
        envFrom:
          - secretRef:
              name: my-first-secret
          - secretRef:
              name: my-second-secret
            prefix: FUNKY_

The Pod will know the following ENV:

ALPHA="earth"
BRAVO="mars"
FUNKY_BRAVO="saturn"
FUNKY_CHARLIE="neptune"

Importing a specific value from a Secret

See EnvVar and EnvVarSource and SecretKeySelector

Using env and secretKeyRef we can import specific values from a Secret:

kind: DeploymentConfig
apiVersion: v1
spec:
  template:
    spec:
      containers:
      - name: my-container
        env:
          - name: MY_KINDA_THING
            valueFrom:
              secretKeyRef:
                key: ALPHA
                name: my-first-secret