[
https://issues.apache.org/jira/browse/AIRFLOW-4301?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16816604#comment-16816604
]
Hüdaverdi Cakir commented on AIRFLOW-4301:
------------------------------------------
Here is an example for the workaround mentioned in the description above:
{code:python}
mnt_cred1 = VolumeMount('vol-creds',
mount_path='/usr/src/app/config/secret1.json',
sub_path='secret-file1', read_only=True)
mnt_cred2 = VolumeMount('vol-creds',
mount_path='/usr/src/app/config/secret2.json',
sub_path='secret-file2', read_only=True)
volume_cred = Volume(name = 'vol-creds', configs = {
'secret': {
'secretName': 'k8s-creds'
}
})
{code}
> Secrets in KubernetesPodOperator are not mapped as expected for deploy_type
> volume
> ----------------------------------------------------------------------------------
>
> Key: AIRFLOW-4301
> URL: https://issues.apache.org/jira/browse/AIRFLOW-4301
> Project: Apache Airflow
> Issue Type: Bug
> Components: kubernetes
> Affects Versions: 1.10.2
> Reporter: Hüdaverdi Cakir
> Priority: Major
>
> Consider following secret configuration:
> {code:python}
> secret1 = Secret('volume', '/usr/src/app/config/secret1.json', 'k8s-creds',
> 'secret-file1')
> secret2 = Secret('volume', '/usr/src/app/config/secret2.json', 'k8s-creds',
> 'secret-file2')
> {code}
> h2. observed
> When this configuration is deployed via the KubernetesPodOperator, following
> files are visible in the pod (container):
> {code:bash}
> # ls -l /usr/src/app/config/secret1.json
> total 0
> lrwxrwxrwx 1 root root 10 Apr 12 18:17 secret-file1 ->
> ..data/secret-file1
> lrwxrwxrwx 1 root root 15 Apr 12 18:17 secret-file2 ->
> ..data/secret-file2
> lrwxrwxrwx 1 root root 11 Apr 12 18:17 secret-file3 ->
> ..data/secret-file3
> # ls -l /usr/src/app/config/secret2.json
> total 0
> lrwxrwxrwx 1 root root 10 Apr 12 18:17 secret-file1 ->
> ..data/secret-file1
> lrwxrwxrwx 1 root root 15 Apr 12 18:17 secret-file2 ->
> ..data/secret-file2
> lrwxrwxrwx 1 root root 11 Apr 12 18:17 secret-file3 ->
> ..data/secret-file3
> {code}
> As you can see, all secrets were mapped per {{deploy_target}} (e.g.
> secret1.json), regardless what {{key}} (e.g. secret-file1) was provided. This
> also includes a third key (secret-file3) which was never meant to be exposed.
> h2. expected
> For {{deploy_type=volume}}, when {{key}} is provided, {{deploy_target}}
> should be considered as a single file, and not as a folder.
> Whereas, when {{key}} is not provided, then {{deploy_target}} should be
> considered as a folder and all secret keys under given secret should be
> mapped.
> h2. workaround
> Using {{VolumeMount}} and {{Volume}} for mapping secrets manually.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
