livenessProbe with secret not working in kubernetes

Question

I am trying to pass livenessProbe in my kubernetes deployment yaml file to perform the health of my application. so, I created a secret with token value and passing as below

      livenessProbe:
        httpGet:
          path: test/actuator/health
          port: 9001
          httpHeaders:
          - name: Authorization
            valueFrom:
              secretKeyRef:
                name: actuator-token
                value: token

but I am getting the below error

error: error validating "deployment.yaml": error validating data: [ValidationError(Deployment.spec.template.spec.containers[0].livenessProbe.httpGet.httpHeaders[0]): unknown field "valueFrom" in io.k8s.api.core.v1.HTTPHeader, ValidationError(Deployment.spec.template.spec.containers[0].livenessProbe.httpGet.httpHeaders[0]): missing required field "value" in io.k8s.api.core.v1.HTTPHeader, ValidationError(Deployment.spec.template.spec.containers[0].readinessProbe.httpGet.httpHeaders): invalid type for io.k8s.api.core.v1.HTTPGetAction.httpHeaders: got "map", expected "array"]; if you choose to ignore these errors, turn validation off with --validate=false

Kindly suggest and appreciate for the help.

Also let us know is their any better way of handling tokens as I don't want to provide token value directly on my deployment yaml file.

why will you perform a liveness probe using secret ? can you explain your use case better. answere to your error is that .. httpHeaders only supports value and name field does not handle valueFrom — DT., Feb 05 '20 at 14:36
If we provide the value directly it is working as expected but the authorization is exposed.. so, I am thinking to encrypt using secret. Kindly advice — magic, Feb 05 '20 at 15:09
read secret it into an environment variable and then pass it to livenessProbe .. check updated answer for suggestion .. — DT., Feb 05 '20 at 15:17

DT. · Accepted Answer · 2020-02-05T15:20:48.943

httpHeaders only supports value and name field does not handle valueFrom

$ kubectl explain pod.spec.containers.livenessProbe.httpGet.httpHeaders

KIND:     Pod
VERSION:  v1

RESOURCE: httpHeaders <[]Object>

DESCRIPTION:
     Custom headers to set in the request. HTTP allows repeated headers.

     HTTPHeader describes a custom header to be used in HTTP probes

FIELDS:
   name <string> -required-
     The header field name

   value        <string> -required-
     The header field value

You could try using env variable like.

spec:
  containers:
  - name: mycontainer
    image: myimage
    env:
      - name: MY_SECRET
        valueFrom:
          secretKeyRef:
            name: actuator-token
            key: token
    livenessProbe:
        httpGet:
          path: test/actuator/health
          port: 9001
          httpHeaders:
          - name: Authorization
            value: $SECRET

Thanks for the details provided. I have converted my authorization token value "Bearer 123123123"as base64 and created as a secret. now I passed the value as said above... I see i am getting the error " Liveness probe failed: HTTP probe failed with statuscode: 401" . Is that I need to decode again while passing it to value field ?? ``` Value: $MY_SECRET | base64 --decode. Secondly above I see the value as $SECRET... I think it should be $MY_SECRET right?? — magic, Feb 06 '20 at 18:14

score 6 · Answer 2 · answered May 06 '20 at 10:36

Not sure that @DT answer gonna work, there no documentation for that feature.

Also I made some tests and the example below not working for me:

spec:
  containers:
  - name: mycontainer
    image: myimage
    env:
      - name: TOKEN
        value: '12345'
    livenessProbe:
      httpGet:
        path: /v1/health
        port: 80
        httpHeaders:
        - name: Authorization
          value: Apikey $TOKEN

I'm getting 401 for my application because it can't substitute env variable for header value. I even tried many other options with single/double quotes, with brackets, none of them working.

Otherwise, you can use exec instead of httpGet, but it requires to have curl installed in your docker image.

spec:
  containers:
  - name: mycontainer
    image: myimage
    env:
      - name: TOKEN
        value: '12345'
    livenessProbe:
      exec:
        command:
        - bash
        - -c
        - 'curl --fail http://localhost/v1/health --header "Authorization: Apikey $TOKEN"'
    initialDelaySeconds: 30
    periodSeconds: 15

If you want to use valueFrom from your secret you don't need to decode variable inside a container. I will be already decoded.

In case you can't add curl package to your image, better to consider writing custom script based on language your application developed. Here is example for js: https://blog.sixeyed.com/docker-healthchecks-why-not-to-use-curl-or-iwr/

Also, check this question, there a similar answer How to use basic authentication in a HTTP liveness probe in Kubernetes?

livenessProbe with secret not working in kubernetes

2 Answers2