How to create CloudSQL Proxy credentials as secrets on GKE
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
I've followed the steps at https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.
My issue is that in the code I copied from the site:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.
I think I'm supposed to create the credentials as a secret via
kubectl create secret generic cloudsql-instance-credentials --from-file=k8ssecretsmy-credentials.json
But after that I have no idea what to do. How does this secret become the path /secrets/cloudsql/credentials.json?
kubernetes google-cloud-sql gke cloud-sql-proxy asked Nov 23 '18 at 14:28
shalvahshalvah
644413
add a comment |
I've followed the steps at https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.
My issue is that in the code I copied from the site:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.
I think I'm supposed to create the credentials as a secret via
kubectl create secret generic cloudsql-instance-credentials --from-file=k8ssecretsmy-credentials.json
But after that I have no idea what to do. How does this secret become the path /secrets/cloudsql/credentials.json?
kubernetes google-cloud-sql gke cloud-sql-proxy asked Nov 23 '18 at 14:28
shalvahshalvah
644413
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33
add a comment |
I've followed the steps at https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.
My issue is that in the code I copied from the site:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.
I think I'm supposed to create the credentials as a secret via
kubectl create secret generic cloudsql-instance-credentials --from-file=k8ssecretsmy-credentials.json
But after that I have no idea what to do. How does this secret become the path /secrets/cloudsql/credentials.json?
kubernetes google-cloud-sql gke cloud-sql-proxy asked Nov 23 '18 at 14:28
shalvahshalvah
644413
I've followed the steps at https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine to set up MySQL user accounts and service accounts. I've downloaded the JSON file containing my credentials.
My issue is that in the code I copied from the site:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
the path /secrets/cloudsql/credentials.json is specified and I have no idea where it's coming from.
I think I'm supposed to create the credentials as a secret via
kubectl create secret generic cloudsql-instance-credentials --from-file=k8ssecretsmy-credentials.json
But after that I have no idea what to do. How does this secret become the path /secrets/cloudsql/credentials.json?
kubernetes google-cloud-sql gke cloud-sql-proxy kubernetes google-cloud-sql gke cloud-sql-proxy asked Nov 23 '18 at 14:28
shalvahshalvah
644413
asked Nov 23 '18 at 14:28
shalvahshalvah
644413
asked Nov 23 '18 at 14:28
shalvahshalvah
644413
asked Nov 23 '18 at 14:28
shalvahshalvah
644413
asked Nov 23 '18 at 14:28
shalvahshalvah
644413
644413
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33
add a comment |
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33
add a comment |
2 Answers
2
active
oldest
votes
you have to add a volume entry under the spec like so:
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 420
secretName: cloudsql-instance-credentials
Note: This belongs to the deployment spec not the container spec.
answered Nov 23 '18 at 14:30
griesgries
853422
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
add a comment |
Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.
- create secret/configmap
- add a volume for the secret in
.spec.volumesin the pod (if you deploy the pod using deployment then add volume in.spec.template.spec.volumes) - mount the created volume in
.spec.container.volumemount
Ref: official kubernetes doc
There is a sample for your use case:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 511
secretName: cloudsql-instance-credentials
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53448509%2fhow-to-create-cloudsql-proxy-credentials-as-secrets-on-gke%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
you have to add a volume entry under the spec like so:
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 420
secretName: cloudsql-instance-credentials
Note: This belongs to the deployment spec not the container spec.
answered Nov 23 '18 at 14:30
griesgries
853422
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
add a comment |
you have to add a volume entry under the spec like so:
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 420
secretName: cloudsql-instance-credentials
Note: This belongs to the deployment spec not the container spec.
answered Nov 23 '18 at 14:30
griesgries
853422
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
add a comment |
you have to add a volume entry under the spec like so:
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 420
secretName: cloudsql-instance-credentials
Note: This belongs to the deployment spec not the container spec.
answered Nov 23 '18 at 14:30
griesgries
853422
you have to add a volume entry under the spec like so:
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 420
secretName: cloudsql-instance-credentials
Note: This belongs to the deployment spec not the container spec.
answered Nov 23 '18 at 14:30
griesgries
853422
answered Nov 23 '18 at 14:30
griesgries
853422
answered Nov 23 '18 at 14:30
griesgries
853422
answered Nov 23 '18 at 14:30
griesgries
853422
853422
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
add a comment |
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
1
1
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
Thanks, that worked. Further reading; kubernetes.io/docs/tasks/inject-data-application/…
– shalvah
Nov 23 '18 at 15:21
add a comment |
Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.
- create secret/configmap
- add a volume for the secret in
.spec.volumesin the pod (if you deploy the pod using deployment then add volume in.spec.template.spec.volumes) - mount the created volume in
.spec.container.volumemount
Ref: official kubernetes doc
There is a sample for your use case:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 511
secretName: cloudsql-instance-credentials
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
add a comment |
Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.
- create secret/configmap
- add a volume for the secret in
.spec.volumesin the pod (if you deploy the pod using deployment then add volume in.spec.template.spec.volumes) - mount the created volume in
.spec.container.volumemount
Ref: official kubernetes doc
There is a sample for your use case:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 511
secretName: cloudsql-instance-credentials
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
add a comment |
Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.
- create secret/configmap
- add a volume for the secret in
.spec.volumesin the pod (if you deploy the pod using deployment then add volume in.spec.template.spec.volumes) - mount the created volume in
.spec.container.volumemount
Ref: official kubernetes doc
There is a sample for your use case:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 511
secretName: cloudsql-instance-credentials
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.
- create secret/configmap
- add a volume for the secret in
.spec.volumesin the pod (if you deploy the pod using deployment then add volume in.spec.template.spec.volumes) - mount the created volume in
.spec.container.volumemount
Ref: official kubernetes doc
There is a sample for your use case:
- name: cloudsql-proxy
image: gcr.io/cloudsql-docker/gce-proxy:1.11
command: ["/cloud_sql_proxy",
"-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
securityContext:
runAsUser: 2 # non-root user
allowPrivilegeEscalation: false
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
volumes:
- name: cloudsql-instance-credentials
secret:
defaultMode: 511
secretName: cloudsql-instance-credentials
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
answered Nov 23 '18 at 15:30
Shudipta SharmaShudipta Sharma
1,220414
1,220414
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53448509%2fhow-to-create-cloudsql-proxy-credentials-as-secrets-on-gke%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
if you post your complete deployment.yml I can give you the complete solution.
– gries
Nov 23 '18 at 14:33