How to set up an environment variables on google kubernetes engine?

Question

I am using Firebase in my GoLang project hosted on Google Kubernetes Engine.

Steps I followed:

Enable firebase admin SDK on the firebase account. It generated a service account JSON for me. This also created a service account under my Google console service credentials.
Followed this answer and add a new secret key using kubectl create secret generic google-application-credentials --from-file=./sample-project.json

Made changes to my deployment.YAML file (added volume mounts, and environment variable in)

spec:
  containers:
  - image: gcr.io/sample-ee458/city:0.27
  name: city-app
  volumeMounts:
  - name: google-application-credentials-volume
    mountPath: /etc/gcp
    readOnly: true 
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
  value: /etc/gcp/application-credentials.json

setup volume in the same file

volumes:
- name: google-application-credentials-volume
secret:
  secretName: google-application-credentials
  items:
  - key: application-credentials.json # default name created by the create secret from-file command
  path: application-credentials.json

Run kubectl apply -f deployment.yaml and deploy using docker push command.

It's throwing me error getting credentials using google_application_credentials environment variable gke. What am I missing here? Anny hint would be appreciable.

Amit Pal · Accepted Answer · 2021-04-03 10:22:39Z

7

Finally, I figure out how to copy it and use the environment variable. Here is. the updated YAMLfile

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      volumes:
      - name: google-cloud-keys
        secret:
          secretName: gac-keys
      containers:
      - name: my-app
        image: us.gcr.io/my-app
        volumeMounts:
        - name: google-cloud-keys
          mountPath: /var/secrets/google
          readOnly: true
        env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /var/secrets/google/new-file-name.json

answered Apr 3, 2021 at 10:22

Amit Pal

11.1k31 gold badges87 silver badges170 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jonas · Accepted Answer · 2021-04-01 17:59:37Z

2

You can use a Secret in two different ways:

Mount the Secret as a volume and access it as a file
Map the Secret to environment variables and access it by reading the variable

You seem to have mixed them both. Decide if you want to access it as a file (recommended) or as an environment variable.

See examples of both in the documentation:

Example - accessing it as an environment variable

First, create the Secret, this can be done as you did:

kubectl create secret generic google-application-credentials --from-file=./application-credentials.json

I want to access it as an environment variable.

To expose the secret as an environment variable in the Pod or Deployment, write your Pod template as:

  containers:
  - name: city-app
    image: gcr.io/sample-ee458/city:0.27
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        valueFrom:
          secretKeyRef:
            name: google-application-credentials  # name of the Secret
            key: application-credentials.json

When accessing the Secret as an environment variable, you don't need to add it as a volume.

edited Apr 1, 2021 at 17:59

answered Apr 1, 2021 at 13:28

Jonas

131k103 gold badges330 silver badges408 bronze badges

6 Comments

Amit Pal Over a year ago

Thanks for the answer. I want to access it as an environment variable. Does that mean kubectl create secret generic.... command will create a secret key in GKE. Where and how. should I map the GOOGLE_APPLICATION_CREDENTIALS with json file?

Amit Pal Over a year ago

Ah! Understand. BTW what is application-credentials.json here? Are you referring to sample-project.json?

Jonas Over a year ago

Yeah, you have mixed names there too. I updated so my kubectl create secret and the Pod-yaml has the same file name now.

Amit Pal Over a year ago

Something is wrong: After applying the above configuration I am getting this:

google: error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable: open  open {\n  \"type\": \"service_account\",\n  \"project_id\": ....: file name too long"}* Closing connection 0

It is pickinng up the file content instead of entire file using name.

Jonas Over a year ago

Yes, that is how it works when you access the content through an environment variable

|

guillaume blaquiere · Accepted Answer · 2021-04-01 19:10:04Z

2

The current answer is correct about secret, env vars and volumes. However, if you try to load authentication in GKE, I absolutely don't recommend to use Service account key file.

On GKE, there is a powerful feature named workload identity. It act exactly as metadata server on a compute engine instance (and other product) but at pod and namespace level (create a proxy that intercept the metadata server call and redirect them to the correct credential, configured with workload identity).

It's more secure and you don't have to keep and manage secret file, with all the constraints and the risk that involve.

answered Apr 1, 2021 at 19:10

guillaume blaquiere

76.6k3 gold badges65 silver badges102 bronze badges

Collectives™ on Stack Overflow

How to set up an environment variables on google kubernetes engine?

3 Answers 3

Comments

Example - accessing it as an environment variable

6 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Example - accessing it as an environment variable

6 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related