Automatically generated strings for secrets using yaml config

Question

I have a deployment config for an app, that (among other things) creates a secret for a mysql database:

---
apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  MYSQL_USER: my_user
  MYSQL_PASSWORD: my_random_secret
  MYSQL_DATABASE: my_db
  MYSQL_ROOT_PASSWORD: my_random_secret
---
etc...

The deployment file is under source control, so I don't want to place the secrets there.

Does anyone know how I can tell Kubernetes to generate random strings for each variable which has my_random_secret as a value in my example? Preferably something that can be configured using the yaml file, without needing to invoke any extra commands.

Ok. I ask because OpenShift provides a way to do this out of the box matching specific regex. Helm also can provide this I believe. If your not using Helm, @aerokite answer looks good — PhilipGough, Jan 29 '18 at 09:47
There are some other way. https://github.com/mittwald/kubernetes-secret-generator. I thing those are too complicated for simple use. — Shahriar, Jan 29 '18 at 10:39

Shahriar · Answer 1 · 2018-04-09T10:40:32.433

As far I have understood that you do not want to keep your secret information locally. So that you need to generate them when you are creating that secret.

I think there is a way to create Kubernetes resource using go-template. Didn't find enough information for that. I can't help you in this way.

But you can also create secret using script. And your secret will not be exposed.

Following script can help you in that case. This will generate random password for you and will create secret with that.

cat <<EOF | kubectl create -f -
apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  MYSQL_PASSWORD: $(head -c 24 /dev/random | base64)
  MYSQL_ROOT_PASSWORD: $(head -c 24 /dev/random | base64)
stringData:
  MYSQL_USER: my_user
  MYSQL_DATABASE: my_db
EOF

Run this script.

Hope it will work for you

Do NOT use current time as only entropy source for secrets (encryption keys, passwords, etc)! After hashing, such password *looks* like a strong 32-char password but the actual entropy stays very low, 1 option per second. E.g. if attacker knows on which day & hour this was run, there are only 3600 possible passwords to try. Always create secrets from a "cryptographically secure" source. Something like `head -c 24 /dev/random | base64` is a much better start. — Beni Cherniavsky-Paskin, Apr 09 '18 at 10:37

score 3 · Answer 2 · answered Jan 18 '22 at 17:39

If you are using Helm chart, you can do this:

apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  MYSQL_USER: bXlfdXNlcgo=
  MYSQL_PASSWORD: {{ randAlphaNum 16 | b64enc }}
  MYSQL_DATABASE: bXlfZGIK
  MYSQL_ROOT_PASSWORD: {{ randAlphaNum 16 | b64enc }}

Here,

echo "my_user" | base64 => bXlfdXNlcgo= &
echo "my_db" | base64 => bXlfZGIK

Otherwise, we can have a similar kind of feature. Or, if you want to generate it from the bash/shell script we can have $(head /dev/urandom | LC_ALL=C tr -dc A-Za-z0-9 | head -c16 | base64) as a unique password generator on the shell.

What happens when the chart is changed, e.g. someone changes it to `randAlphaNum 24` later on. Does this variable get a new value, and is it now different from the one used to create the database? — wvengen, Sep 12 '22 at 09:44

nyet · Answer 3 · 2018-12-01T16:17:10.630

You can also use open ssl

openssl rand -base64 32

Or if you need plaintext/numbers:

openssl rand -base64 32 | tr -cd '[:alpha:]\n'

Or if you don't want the trailing CR:

openssl rand -base64 32 | tr -cd '[:alpha:]'

Note that anything longer than -base64 48 might add CRs to the output. Adjust your tr to taste, e.g.

openssl rand -base64 128 | tr -cd '[:alpha:]'

will concatenate the multiple lines from openssl, but omit a trailing \n as well

Automatically generated strings for secrets using yaml config

3 Answers3

Linked