Skip to content

Instantly share code, notes, and snippets.

@flypenguin

flypenguin/k8s-secret-mount-test.yaml

Last active September 3, 2024 10:42
Show Gist options
  • Save flypenguin/6d6ca3b0757ca0f5e16f081a934b56a8 to your computer and use it in GitHub Desktop.
Save flypenguin/6d6ca3b0757ca0f5e16f081a934b56a8 to your computer and use it in GitHub Desktop.
Download ZIP
Test various possibilities to mount secrets in K8S (ownership, file permissions)
Raw
k8s-secret-mount-test.yaml
---
apiVersion: v1
kind: Secret
metadata:
name: mount-test
namespace: default
type: Opaque
stringData:
id_rsa: "begin openssh private key ..."
---
# file 0600, but owned by root - unreadable by user
apiVersion: v1
kind: Pod
metadata:
name: mount-test-1
namespace: default
spec:
containers:
- name: shell
image: ubuntu:24.04
args: [sleep, infinity]
volumeMounts:
- mountPath: /id_rsa
name: mount-test
subPath: id_rsa
- mountPath: /mounted-file
name: mount-test
securityContext:
runAsGroup: 65533
runAsUser: 65533
volumes:
- name: mount-test
secret:
defaultMode: 256
secretName: mount-test
---
# file 0660, so ssh will complain and ignore it
apiVersion: v1
kind: Pod
metadata:
name: mount-test-2
namespace: default
spec:
containers:
- name: shell
image: ubuntu:24.04
args: [sleep, infinity]
volumeMounts:
- mountPath: /id_rsa
name: mount-test
subPath: id_rsa
- mountPath: /mounted-file
name: mount-test
securityContext:
runAsGroup: 65533
runAsUser: 65533
volumes:
- name: mount-test
secret:
defaultMode: 256
secretName: mount-test
securityContext:
fsGroup: 65533
---
# that could in fact work - running as root
# file 0600, readable by root
apiVersion: v1
kind: Pod
metadata:
name: mount-test-3
namespace: default
spec:
containers:
- name: shell
image: ubuntu:24.04
args: [sleep, infinity]
volumeMounts:
- mountPath: /id_rsa
name: mount-test
subPath: id_rsa
- mountPath: /mounted-file
name: mount-test
securityContext:
runAsUser: 0
volumes:
- name: mount-test
secret:
defaultMode: 256
secretName: mount-test
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment