Mount Secrets

Mount Kubernetes Secrets into workspace containers to provide sensitive configuration data such as credentials, API keys, and certificates.

Before you begin

  • You have an active oc session with your project. See Getting started with the CLI. Warning

    By default, applying a Secret with the controller.devfile.io/mount-to-devworkspace: 'true' label restarts all running workspaces in the project. To mount the Secret only at workspace start and prevent automatic restarts, add the controller.devfile.io/mount-on-start: 'true' annotation.

Procedure

  1. Create a Secret with the required labels and annotations: 
    kind: Secret
apiVersion: v1
metadata:
  name: my-credentials
  labels:
    controller.devfile.io/mount-to-devworkspace: 'true'
    controller.devfile.io/watch-secret: 'true'
  annotations:
    controller.devfile.io/mount-as: file
    controller.devfile.io/mount-path: /etc/my-credentials
type: Opaque
data:
  api-key: <base64_encoded_api_key>

    where:

    controller.devfile.io/mount-to-devworkspace
    Required label to mount the Secret to all workspaces.
    controller.devfile.io/watch-secret
    Watch the Secret for changes and update mounted files.
    controller.devfile.io/mount-as
    Mount type: file, subpath, or env.
    controller.devfile.io/mount-path
    Path where the Secret data is mounted.
  2. Apply the Secret to your project: 
    $ oc apply -f my-credentials.yaml -n <your_namespace>
  3. Optional: Add annotations to the Secret to customize the mounting behavior.
    Expand
    Table 1. Secret mounting annotations
    Annotation Description

    controller.devfile.io/mount-path: <path>

    Overrides the default mount path. The default mount path is /etc/secret/<Secret_name>.

    controller.devfile.io/mount-as: file

    Each key in the Secret data becomes a file in the mount path directory.

    controller.devfile.io/mount-as: subpath

    Similar to file, but uses subPath volumes for better compatibility.

    controller.devfile.io/mount-as: env

    Each key-value pair becomes an environment variable in all workspace containers.

    controller.devfile.io/mount-on-start: 'true'

    When set to true, the Secret is mounted only when a workspace starts, not while it is already running. This prevents workspace restarts when the Secret is created.

    controller.devfile.io/mount-to-devworkspace-include:

    Specifies a comma-separated list of Dev Workspace name patterns. When set, the Secret is mounted only to workspaces whose names match at least one pattern.

    controller.devfile.io/mount-to-devworkspace-exclude:

    Specifies a comma-separated list of Dev Workspace name patterns. When set, the Secret is mounted to all workspaces except those whose names match a pattern.
    Note

    When both controller.devfile.io/mount-to-devworkspace-include and controller.devfile.io/mount-to-devworkspace-exclude annotations are set, the Secret is mounted only to workspaces that match the include pattern and do not match the exclude pattern.

    For example, to mount Secret data as environment variables:

    kind: Secret
apiVersion: v1
metadata:
  name: my-env-secret
  labels:
    controller.devfile.io/mount-to-devworkspace: 'true'
    controller.devfile.io/watch-secret: 'true'
  annotations:
    controller.devfile.io/mount-as: env
type: Opaque
stringData:
  DATABASE_URL: postgresql://localhost:5432/mydb
  API_SECRET: my-secret-key

    For example, to mount a Maven settings.xml file to the /home/user/.m2/ path using subpath:

    kind: Secret
apiVersion: v1
metadata:
  name: maven-settings
  labels:
    controller.devfile.io/mount-to-devworkspace: 'true'
    controller.devfile.io/watch-secret: 'true'
  annotations:
    controller.devfile.io/mount-path: /home/user/.m2/
    controller.devfile.io/mount-as: subpath
type: Opaque
stringData:
  settings.xml: |
    <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
    </settings>

    After the workspace starts, the /home/user/.m2/settings.xml file is available in the Dev Workspace containers. To use a custom path with Maven, run mvn --settings /home/user/.m2/settings.xml clean install.

  4. Start or restart your workspace to apply the mounted Secret.

Results

  • For file or subpath mounts, verify the Secret data is available at the mount path: 
    $ ls /etc/my-credentials
  • For env mounts, verify the environment variables are set: 
    $ echo $DATABASE_URL