Automatically generated strings for secrets using yaml config

Solution 1:

As far I have understood that you do not want to keep your secret information locally. So that you need to generate them when you are creating that secret.

I think there is a way to create Kubernetes resource using go-template. Didn't find enough information for that. I can't help you in this way.

But you can also create secret using script. And your secret will not be exposed.

Following script can help you in that case. This will generate random password for you and will create secret with that.

cat <<EOF | kubectl create -f -
apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  MYSQL_PASSWORD: $(head -c 24 /dev/random | base64)
  MYSQL_ROOT_PASSWORD: $(head -c 24 /dev/random | base64)
stringData:
  MYSQL_USER: my_user
  MYSQL_DATABASE: my_db
EOF

Run this script.

Hope it will work for you

Solution 2:

If you are using Helm chart, you can do this:

apiVersion: v1
kind: Secret
metadata:
  name: mysql-secret
type: Opaque
data:
  MYSQL_USER: bXlfdXNlcgo=
  MYSQL_PASSWORD: {{ randAlphaNum 16 | b64enc }}
  MYSQL_DATABASE: bXlfZGIK
  MYSQL_ROOT_PASSWORD: {{ randAlphaNum 16 | b64enc }}

Here,

• echo "my_user" | base64 => bXlfdXNlcgo= &
• echo "my_db" | base64 => bXlfZGIK

Otherwise, we can have a similar kind of feature. Or, if you want to generate it from the bash/shell script we can have $(head /dev/urandom | LC_ALL=C tr -dc A-Za-z0-9 | head -c16 | base64) as a unique password generator on the shell.