How to pass mount a single file as volume to KubernetesPodOperator?

Question

I have a docker image that expects a mounted JSON credentials file on startup. The container is started through a command like:

docker run -v [CREDENTIALS_FILE]:/credentials.json image_name

This image lives on Google Container Registry and I'd like to start it in a Cloud Composer dag using the KubernetesPodOperator.

Is there a way mount a single file through the KubernetesPodOperator? Ideally, this file would be hosted at a Cloud Storage location. I read that there is a volume/volume_mount options but it seems like a heavy-lift to pass a single file through -- hoping there was another option I'm overlooking.

KubernetesPodOperator(namespace='default',
                      image="gcr.io/image_name,
                      name="start-container-image",
                      task_id="start-container-image",
                      volume=[?],
                      volume_mounts=[?],
                      dag=dag)

David Beaudway · Answer 1 · 2019-09-11T20:45:56.320

I figured this out using Patrick W's advice and passing a configMap through. I should likely update this to use a secret, but here's the implementation so far:

First I created the configMap: kubectl create configmap credentials-configmap --from-file=./credentials.json

Next, in my DAG I setup the volume options. Notice, I had to modify the mount_path into a sub-directory "/config/" because it errs out when mounting to "/".

volume_mount = VolumeMount('creds-volume',
                            mount_path='/config/',
                            sub_path=None,
                            read_only=False)

volume_config = {
    'configMap': {
        'name': 'creds-volume'
    }
}

volume = Volume(name='creds-volume', configs=volume_config)

This is passed to the KuberenetesPodOperator:

KubernetesPodOperator(
volumes=[volume],
volume_mounts=[volume_mount],
...excluding other options for brevity
)

Finally, this is utilized by the container during a startup script like so: gcloud auth activate-service-account --key-file=/config/credentials.json

score 1 · Answer 2 · answered Sep 11 '19 at 12:15

k8s allows you to either mount volumes (a configMap for static data would do and is not terribly heavy lifting). Otherwise, if you need to pull data from remote a remote storage that does not support backing a PV (such as GCS) you'll need to pull the data directly.

You might want to consider using an initContainer that will just be used to download the data from your remote storage and save it locally so your main application can run using the data locally.

score 0 · Answer 3 · answered Apr 16 '21 at 07:57

Building up on David's answer, to fix permission issues with the mounted volume, use the following:

volume_config = {
    "configMap": {
        "name": "foobar",
        "defaultMode": 0o744
    }
}

Notice the default mode is written as 0o744 in Python 3, as opposed to 0744 in YAML.

How to pass mount a single file as volume to KubernetesPodOperator?

3 Answers3