Using kustomize and secretGenerator how do you create a secret under one key but from multiple files?

Question

I have 2 separate properties files which contain secrets. I would like to use secretGenerator and merge them into a single property (i.e. app_properties).

Here's the code I'm using but it's not working:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
secretGenerator:
- name: my-secret
  files:
  - app_properties=app-default.properties
  - app_properties=app-dev.properties
generatorOptions:
  disableNameSuffixHash: true

This obviously fails with an error:

error: configmap my-secret illegally repeats the key `app_properties`

I seem to be missing something, but not sure what. Looking at the docs it does sound like I could use mergeBehavior and have the secretGenerator create two secrets (one that creates and one that merges), but that did not work as well.

Not sure if what I'm trying to do is possible and if I'm in the right direction. Any ideas?

Answer 1

You can't create a secret with a single key that contains data from multiple sources.

Assuming that app-default.properties contains:

name=TestApp
version=1.0.0

And app-dev.properties contains:

debug=true

You can create a secret with multiple keys, one for each file:

secretGenerator:
  - name: my-secret
    files:
    - app-default.properties
    - app-dev.properties

That gets you:

apiVersion: v1
data:
  app-default.properties: |
    version=1.0
    name=TestApp
  app-dev.properties: |
    debug=true
kind: ConfigMap
metadata:
  name: my-secret

You can create a secret with multiple keys corresponding to the non-conflicting values in multiple property-style files, like this:

secretGenerator:
  - name: my-secret
    envs:
    - app-default.properties
    - app-dev.properties

That gets you:

apiVersion: v1
data:
  debug: "true"
  name: TestApp
  version: "1.0"
kind: ConfigMap
metadata:
  name: my-secret

(This won't work if both files define the same keys.)

But if your goal is ultimately to have a file in your pod that contains the merged content of both files, you will need to add some logic in your manifests. For example, we could use an initContainer to perform the merge operation.

Start with the "multiple files" version of the secret...

secretGenerator:
  - name: my-secret
    files:
    - app-default.properties
    - app-dev.properties

And then do something like this:

spec:
  volumes:
    - name: inputConfig
      secret:
        secretName: my-secret
    - name: outputConfig
      emptyDir: {}
  initContainers:
    - name: merge-config
      image: docker.io/alpine:latest
      volumeMounts:
      - name: inputConfig
        mountPath: /config-in
      - name: outputConfig
        mountPath: /config-out
      command:
      - /bin/sh
      - -c
      - |
        cat /config-in/app-default.properties /config-in/app-dev.properties |
          tac |
          awk -F= '!seen[$1]++' > /config-out/app.properties

And in your application container, mount the outputConfig volume and use the app.properties file.

In this example, if app-default.properties has:

name=TestApp
version=1.0.0

And app-dev.properties contains:

debug=true
version=dev

Then the generated app.properties file will have:

version=dev
debug=true
name=MyApp