A Kubernetes Secret is a configuration object for sensitive information that requires protected access. Application pods consume its values through their Deployment templates, commonly as environment variables. section 2.1.2 section 5.1.2
Infrastructure charts can create Secrets containing connection details for services such as PostgreSQL and Redis. Those values may include URLs, usernames, passwords, certificates, or other application connection data, while Kubernetes Services provide the corresponding endpoints. section 5.1.2 section 5.2.2
A Deployment exposes Secret values to a container with secretKeyRef:
- Set POSTGRES_HOST from the PostgreSQL Secret's postgres-url key. section 5.1.2
- Set POSTGRES_PASSWORD from the postgres-password key. section 5.1.2
- Set REDIS_HOST and REDIS_PASSWORD from the Redis Secret's redis-url and redis-password keys. section 5.1.2
Connecting a service to PostgreSQL
A C4P Deployment can reference the dynamically generated PostgreSQL Secret for POSTGRES_HOST and POSTGRES_PASSWORD. The Secret name and database endpoint depend on the Helm release name used to install the chart. section 5.1.2
Figure 5.3 Connecting a service to a provisioned resource using secrets. #1 A Kubernetes deployment is created to run one of your services, and the pod template contains the environment variables to configure the pods that this deployment will create; #2 The pod is created using the template specified in the deployment resource, which points to a secret that contains the details to connect to the db instance; #3 The container, which is running inside the pod needs to be prepared to consume the environment variables to connect to the db instance.
Trace the flow from a Deployment template to a pod and then to container environment variables backed by a Secret. section 5.1.2
