Correct way to create a k8s secret?

Question

I am not sure if I'm interpreting the output from my container correctly, but I am seeing the following output from sequelize in the logs:

Nates-MacBook-Pro:k8s natereed$ docker logs 1a3e6141d050
...
(node:36) UnhandledPromiseRejectionWarning: SequelizeConnectionError: password authentication failed for user 
"postgres
"

It appears there is an extra newline character in the username, which should be "postgres". The database is configured with the environment variable $POSTGRESS_USERNAME (yes, I know it is mispelled, it is from another author).

src/config/config.ts:    "username": process.env.POSTGRESS_USERNAME

I shelled into the running container and checked that the environment variables are correctly set:

root@backend-feed-75c4f97d6-9tp2f:/usr/src/app# echo $POSTGRESS_USERNAME
postgres
root@backend-feed-75c4f97d6-9tp2f:/usr/src/app# echo $POSTGRESS_PASSWORD
...
root@backend-feed-75c4f97d6-9tp2f:/usr/src/app# echo $POSTGRESS_DB      
mydb

...

To create the secret and then apply, I ran:

echo "postgres" | openssl base64
(edit env-secret.yaml)
kubectl apply -f env-secret.yaml

The contents of the secret:

apiVersion: v1
kind: Secret
metadata:
  name: env-secret
type: Opaque
data:
  POSTGRESS_USERNAME: cG9zdGdyZXMK
  POSTGRESS_PASSWORD: ...

Is this not the correct way to create the k8s secret?

score 7 · Answer 1 · answered Mar 24 '20 at 20:30

7

The simple option:

apiVersion: v1
kind: Secret
metadata:
  name: env-secret
type: Opaque
stringData:
  POSTGRESS_USERNAME: myapp
  POSTGRESS_PASSWORD: supersecret

stringData takes plain strings instead of base-64 encoded []bytes.

answered Mar 24 '20 at 20:30

coderanger

52,400
4
52
75

1

Is there a reason to use Base64 other than to deal with whitespace or other characters that could break the yaml formatting? I copied my YAML from an example. Obviously there is no security in Base64, not sure what the point is. – Nate Reed Mar 25 '20 at 15:51
1

It’s not uncommon for Secrets to include binary data, like Java keystore files for example. But if your data doesn’t include that, then nope! – coderanger Mar 25 '20 at 16:53
Thank you for the answer, this enhances my understanding. – Nate Reed Mar 25 '20 at 21:04

score 3 · Accepted Answer · answered Mar 24 '20 at 20:27

3

echo "postgres" includes a newline at the end of the string which is also included in the encoded secret. Instead, use:

echo -n "postgres" | openssl base64

The -n flag suppresses the newline.

answered Mar 24 '20 at 20:27

Burak Serdar

46,455
3
40
59

Correct way to create a k8s secret?

2 Answers2