Your functions, after deployed to the cluster, can access data stored in secrets and config maps. This data can be mounted as volumes, or assigned to environment variables. You can configure this access interactively by using the Knative CLI kn func commands or manually by editing the function configuration file.

To access secrets and config maps, the function needs to be deployed on the cluster. This functionality is not available to a function running locally.

If a secret or config map value cannot be accessed, the deployment fails with an error message specifying the inaccessible values.

Modifying function access to secrets and config maps interactively

You can manage the secrets and config maps accessed by your function by using the kn func config interactive utility.

Procedure
  1. Run the following command in the function project directory:

    $ kn func config

    Alternatively, you can specify the function project directory using the --path or -p option.

  2. Use the interactive interface to perform the necessary operation. For example, using the utility to list configured volumes produces an output similar to this:

    $ kn func config
    ? What do you want to configure? Volumes
    ? What operation do you want to perform? List
    Configured Volumes mounts:
    - Secret "mysecret" mounted at path: "/workspace/secret"
    - Secret "mysecret2" mounted at path: "/workspace/secret2"

    This scheme shows all operations available in the interactive utility and how to navigate to them:

    kn func config
       ├─> Environment variables
       │               ├─> Add
       │               │    ├─> ConfigMap: Add all key-value pairs from a config map
       │               │    ├─> ConfigMap: Add value from a key in a config map
       │               │    ├─> Secret: Add all key-value pairs from a secret
       │               │    └─> Secret: Add value from a key in a secret
       │               ├─> List: List all configured environment variables
       │               └─> Remove: Remove a configured environment variable
       └─> Volumes
               ├─> Add
               │    ├─> ConfigMap: Mount a config map as a volume
               │    └─> Secret: Mount a secret as a volume
               ├─> List: List all configured volumes
               └─> Remove: Remove a configured volume
  3. Optional. Deploy the function to make the changes take effect:

    $ kn func deploy -p test

Modifying function access to secrets and config maps interactively with specialized commands

Every time you run the kn func config utility, you need to navigate the entire dialogue to select the operation you need, as shown in the previous section. To save steps, you can directly execute a specific operation by running a more specific form of the kn func config command:

  • To list configured environment variables:

    $ kn func config envs [-p <function-project-path>]
  • To add environment variables to the function configuration:

    $ kn func config envs add [-p <function-project-path>]
  • To remove environment variables from the function configuration:

    $ kn func config envs remove [-p <function-project-path>]
  • To list configured volumes:

    $ kn func config volumes [-p <function-project-path>]
  • To add a volume to the function configuration:

    $ kn func config volumes add [-p <function-project-path>]
  • To remove a volume from the function configuration:

    $ kn func config volumes remove [-p <function-project-path>]

Adding function access to secrets and config maps manually

You can manually add configuration for accessing secrets and config maps to your function.

Mounting a secret as a volume

  1. Open the func.yaml file for your function.

  2. For each secret you want to mount as a volume, add the following YAML to the volumes section:

    name: test
    namespace: ""
    runtime: go
    ...
    volumes:
    - secret: mysecret
      path: /workspace/secret
    • Substitute mysecret with the name of the target secret.

    • Substitute /workspace/secret with the path where you want to mount the secret.

  3. Save the configuration.

Mounting a config map as a volume

  1. Open the func.yaml file for your function.

  2. For each config map you want to mount as a volume, add the following YAML to the volumes section:

    name: test
    namespace: ""
    runtime: go
    ...
    volumes:
    - configMap: myconfigmap
      path: /workspace/configmap
    • Substitute myconfigmap with the name of the target config map.

    • Substitute /workspace/configmap with the path where you want to mount the config map.

  3. Save the configuration.

Setting environment variable from a key value defined in a secret

  1. Open the func.yaml file for your function.

  2. For each value from a secret key-value pair that you want to assign to an environment variable, add the following YAML to the envs section:

    name: test
    namespace: ""
    runtime: go
    ...
    envs:
    - name: EXAMPLE
      value: '{{ secret:mysecret:key }}'
    • Substitute EXAMPLE with the name of the environment variable.

    • Substitute mysecret with the name of the target secret.

    • Substitute key with the key mapped to the target value.

  3. Save the configuration.

Setting environment variable from a key value defined in a config map

  1. Open the func.yaml file for your function.

  2. For each value from a config map key-value pair that you want to assign to an environment variable, add the following YAML to the envs section:

    name: test
    namespace: ""
    runtime: go
    ...
    envs:
    - name: EXAMPLE
      value: '{{ configMap:myconfigmap:key }}'
    • Substitute EXAMPLE with the name of the environment variable.

    • Substitute myconfigmap with the name of the target config map.

    • Substitute key with the key mapped to the target value.

  3. Save the configuration.

Setting environment variables from all values defined in a secret

  1. Open the func.yaml file for your function.

  2. For every secret for which you want to import all key-value pairs as environment variables, add the following YAML to the envs section:

    name: test
    namespace: ""
    runtime: go
    ...
    envs:
    - value: '{{ secret:mysecret }}' (1)
    1 Substitute mysecret with the name of the target secret.
  3. Save the configuration.

Setting environment variables from all values defined in a config map

  1. Open the func.yaml file for your function.

  2. For every config map for which you want to import all key-value pairs as environment variables, add the following YAML to the envs section:

    name: test
    namespace: ""
    runtime: go
    ...
    envs:
    - value: '{{ configMap:myconfigmap }}' (1)
    1 Substitute myconfigmap with the name of the target config map.
  3. Save the file.