An environment variable is a named runtime value supplied through a process environment. Use it to keep configuration outside the container image, so one container can serve local, testing, and production environments. section 2.3.2
Environment variables support several deployment practices:
- Configure Compose services with values such as database credentials, database names, and development flags. section 2.3.2
- Provide Kubernetes service-discovery data to Pods alongside DNS-based discovery. section 7.3
- Inject sensitive strings from Kubernetes Secrets instead of storing passwords directly in workload configuration. section 11.4.1
A deployment with regular and secret values
A Kubernetes Deployment can set AVATAR_ENDPOINT directly and populate SECRET_KEY through valueFrom and a Secret reference. The application then reads SECRET_KEY from its process environment. section 11.4.1
Listing 2.20 Chapter02/2.3.2_MultipleServices/docker-compose.yaml
services:
frontend: #1
build: ../timeserver #1
command: python3 server.py #1
environment: #1
PYTHONDONTWRITEBYTECODE: 1 #1
ports: #1
- "8080:80" #1
db:
image: mysql:5.7 #2
volumes: #2
- db_data:/var/lib/mysql #2
restart: always #2
environment: #2
MYSQL_ROOT_PASSWORD: super secret password #2
MYSQL_DATABASE: my_database #2
MYSQL_USER: dev_user #2
MYSQL_PASSWORD: another secret password #2
volumes: #3
db_data: #3
Inspect a Compose file that supplies environment values to an application and database service. section 2.3.2
Listing 11.5 Chapter11/11.4.1_StringSecrets/deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: timeserver
spec:
replicas: 1
selector:
matchLabels:
pod: timeserver-pod
template:
metadata:
labels:
pod: timeserver-pod
spec:
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:5
env:
- name: AVATAR_ENDPOINT #1
value: http://robohash-internal #1
- name: SECRET_KEY #2
valueFrom: #2
secretKeyRef: #2
name: secrets-production #2
key: SECRET_KEY #2
#1 A regular plain-text environment variable
#2 An environment variable populated from a Secret
Inspect Kubernetes syntax for direct values and values loaded from a Secret. section 11.4.1
