Unable to mount a Kubernetes secret to ${HOME}/.ssh/id_rsa path.

Following are my secrets.yaml created using

  kubectl create secret generic secret-ssh-auth --type=kubernetes.io/ssh-auth --from-file=ssh-privatekey=keys/id_rsa

apiVersion: v1
data:
  ssh-privatekey: abcdefgh
kind: Secret
metadata:
  name: secret-ssh-auth
  namespace: app
type: kubernetes.io/ssh-auth
---
apiVersion: v1
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
kind: Secret
metadata:
  name: mysecret
  namespace: app
type: Opaque

Following is my deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-helm-test
  labels:
    helm.sh/chart: helm-test-0.1.0
    app.kubernetes.io/name: helm-test
    app.kubernetes.io/instance: nginx
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: helm-test
      app.kubernetes.io/instance: nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: helm-test
        app.kubernetes.io/instance: nginx
    spec:
      serviceAccountName: nginx-helm-test
      securityContext:
        {}
      containers:
        - name: helm-test
          securityContext:
            {}
          image: "nginx:1.16.0"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
          resources:
            {}
          env:
            - name: HOME
              value: /root
          volumeMounts:
            - mountPath: ${HOME}/.ssh/id_rsa
              name: sshdir
              readOnly: true
            - name: foo
              mountPath: /etc/foo
              readOnly: true
      volumes:
        - name: sshdir
          secret:
            secretName: secret-ssh-auth
        - name: foo
          secret:
            secretName: mysecret    

All I wanted is to mount the ssh-privatekey value in ${HOME}/.ssh/id_rsa but for some reason, the above mount does not happen

But at the same time, I was able to see the foo secret correctly in /etc/foo/username. Exhaust to be honest but still want to finish this

What am I doing wrong?

CodePudding user response：

kubectl create secret generic secret-ssh-auth \
--from-file=ssh-privatekey=keys/id_rsa

As you show, creates a Secret but the data key is sss-privatekey and it is created from keys/id_rsa.

When you volume mount it, you reference the file (!) as ssh-privatekey.

      containers:
      - name: ...
          volumeMounts:
            - mountPath: /for/example/secrets
              name: sshdir
              readOnly: true
      volumes:
        - name: sshdir
          secret:
            secretName: secret-ssh-auth

The key will be /for/example/secrets/ssh-privatekey

Customarily, you'd remap the host file to a similarly named file in the secret to make this less confusing, i.e.

kubectl create secret generic secret-ssh-auth \
--from-file=id_rsa=keys/id_rsa

CodePudding user response：

K8s Secret type: kubernetes.io/ssh-auth (i.e. ssh-key-secret) does not work out of the box as mount point for SSH, since it mounts it under the filename ssh-privatekey. To fix this you have to do few things:

1. You need to mount the ssh-privatekey key to id_rsa filename via secret:items:key projection in your volume definition.
2. Mount the secret so it is NOT group/world readable because the default mode/permissions is 0644 (i.e. add defaultMode: 0400 to your VolumeMount) .

Here is what I believe you need to change in your deployment.yaml to fix this problem:

...
          volumeMounts:
            - mountPath: ${HOME}/.ssh
              name: sshdir
              readOnly: true
      volumes:
        - name: sshdir
          secret:
            secretName: secret-ssh-auth
            defaultMode: 0400
         items:
           - key: ssh-privatekey
             path: id_rsa