Inject files from Secrets and ConfigMaps into containers

Inject an OpenShift Secret or a ConfigMap as a file into an OpenShift Dev Spaces container to provide configuration files, certificates, or credentials without embedding them in the container image.

Before you begin

  • You have an active oc session with administrative permissions to the OpenShift cluster. See Getting started with the CLI.
  • You have a running instance of Red Hat OpenShift Dev Spaces.

Procedure

  1. Create a new OpenShift Secret or a ConfigMap in the OpenShift project where OpenShift Dev Spaces is deployed with the required labels: 
    apiVersion: v1
kind: Secret
metadata:
  name: custom-settings
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: <DEPLOYMENT_NAME>-<OBJECT_KIND>
...

    where:

    kind
    Secret for a Secret or ConfigMap for a ConfigMap.
    <DEPLOYMENT_NAME>
    Target deployment: devspaces, devspaces-dashboard, devfile-registry, or plugin-registry.
    <OBJECT_KIND>
    secret for a Secret or configmap for a ConfigMap.
  2. Configure the annotation values. Annotations must indicate that the given object is mounted as a file:
    • che.eclipse.org/mount-as: file - Mounts an object as a file.
    • che.eclipse.org/mount-path: <TARGET_PATH> - To provide a required mount path.

      For a Secret:

      apiVersion: v1
kind: Secret
metadata:
  name: custom-data
  annotations:
    che.eclipse.org/mount-as: file
    che.eclipse.org/mount-path: /data
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: devspaces-secret
...

      For a ConfigMap:

      apiVersion: v1
kind: ConfigMap
metadata:
  name: custom-data
  annotations:
    che.eclipse.org/mount-as: file
    che.eclipse.org/mount-path: /data
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: devspaces-configmap
...
  3. Add data items to the object. Each item name must match the desired file name mounted into the container.

    For a Secret:

    apiVersion: v1
kind: Secret
metadata:
  name: custom-data
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: devspaces-secret
  annotations:
    che.eclipse.org/mount-as: file
    che.eclipse.org/mount-path: /data
data:
  ca.crt: <base64 encoded data content here>

    For a ConfigMap:

    apiVersion: v1
kind: ConfigMap
metadata:
  name: custom-data
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: devspaces-configmap
  annotations:
    che.eclipse.org/mount-as: file
    che.eclipse.org/mount-path: /data
data:
  ca.crt: <data content here>

Results

  • Verify that the file is mounted in the target container: 
    oc exec -n openshift-devspaces deploy/<DEPLOYMENT_NAME> -- ls <TARGET_PATH>/<FILE_NAME>

    Each data item name in the object corresponds to a file name at the mount path. For example, a data item named ca.crt with a mount path of /data results in a file at /data/ca.crt.

    Important

    If you update the Secret or ConfigMap data, re-create the object entirely to make the changes visible in the OpenShift Dev Spaces container.