Environment variables from Secret include new line character

[motomux]

secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  password: MWYyZDFlMmU2N2RmCg==
  username: YWRtaW4K

secret-env-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
    - name: mycontainer
      image: redis
      env:
        - name: SECRET_USERNAME
          valueFrom:
            secretKeyRef:
              name: mysecret
              key: username
        - name: SECRET_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysecret
              key: password
  restartPolicy: Never

Run pod and export environment variables.

kubectl create -f secret.yaml
kubectl create -f secret-env-pod.yaml
kubectl exec -it secret-env-pod bash
root@secret-env-pod:/data# export

Environment variables.

declare -x GOSU_VERSION="1.7"
declare -x HOME="/root"
declare -x HOSTNAME="secret-env-pod"
declare -x KUBERNETES_PORT="tcp://10.55.240.1:443"
declare -x KUBERNETES_PORT_443_TCP="tcp://10.55.240.1:443"
declare -x KUBERNETES_PORT_443_TCP_ADDR="10.55.240.1"
declare -x KUBERNETES_PORT_443_TCP_PORT="443"
declare -x KUBERNETES_PORT_443_TCP_PROTO="tcp"
declare -x KUBERNETES_SERVICE_HOST="10.55.240.1"
declare -x KUBERNETES_SERVICE_PORT="443"
declare -x KUBERNETES_SERVICE_PORT_HTTPS="443"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
declare -x PWD="/data"
declare -x REDIS_DOWNLOAD_SHA1="e56b4b7e033ae8dbf311f9191cf6fdf3ae974d1c"
declare -x REDIS_DOWNLOAD_URL="http://download.redis.io/releases/redis-3.0.7.tar.gz"
declare -x REDIS_VERSION="3.0.7"
declare -x SECRET_PASSWORD="1f2d1e2e67df
"
declare -x SECRET_USERNAME="admin
"
declare -x SHLVL="1"

@pmorie
On Mar 23, 2016 3:07 PM, "motomux" notifications@github.com wrote:

secret.yaml

apiVersion: v1
kind: Secret
metadata:
name: mysecret
type: Opaque
data:
password: MWYyZDFlMmU2N2RmCg==
username: YWRtaW4K

secret-env-pod.yaml

apiVersion: v1
kind: Pod
metadata:
name: secret-env-pod
spec:
containers:
- name: mycontainer
image: redis
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
restartPolicy: Never

Run pod and export environment variables.

kubectl create -f secret.yaml
kubectl create -f secret-env-pod.yaml
kubectl exec -it secret-env-pod bash
root@secret-env-pod:/data# export

Environment variables.

declare -x GOSU_VERSION="1.7"
declare -x HOME="/root"
declare -x HOSTNAME="secret-env-pod"
declare -x KUBERNETES_PORT="tcp://10.55.240.1:443"
declare -x KUBERNETES_PORT_443_TCP="tcp://10.55.240.1:443"
declare -x KUBERNETES_PORT_443_TCP_ADDR="10.55.240.1"
declare -x KUBERNETES_PORT_443_TCP_PORT="443"
declare -x KUBERNETES_PORT_443_TCP_PROTO="tcp"
declare -x KUBERNETES_SERVICE_HOST="10.55.240.1"
declare -x KUBERNETES_SERVICE_PORT="443"
declare -x KUBERNETES_SERVICE_PORT_HTTPS="443"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
declare -x PWD="/data"
declare -x REDIS_DOWNLOAD_SHA1="e56b4b7e033ae8dbf311f9191cf6fdf3ae974d1c"
declare -x REDIS_DOWNLOAD_URL="http://download.redis.io/releases/redis-3.0.7.tar.gz"
declare -x REDIS_VERSION="3.0.7"
declare -x SECRET_PASSWORD="1f2d1e2e67df
"
declare -x SECRET_USERNAME="admin
"
declare -x SHLVL="1"

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#23404

[pmorie]

@motomux thanks for finding this; i will fix it.

[vaijab]

@motomux actually they don't. The reason your secrets contain a new line \n is because the original string contained a new line:

~> echo -n 'MWYyZDFlMmU2N2RmCg==' | base64 -d
1f2d1e2e67df
~> echo -n '1f2d1e2e67df' | base64 -w0
MWYyZDFlMmU2N2Rm~>
~> echo -n 'MWYyZDFlMmU2N2Rm' | base64 -d
1f2d1e2e67df~> 

Hope this helps.

[pmorie]

I guess the question here is, should we try to protect you from yourself if you accidentally create a secret value that ends with a newline? I don't have a use-case ready for when you would want such a key to end with a newline, but I feel that it might be impossible to predict all expectations here, so I'm inclined, after thinking about it, to avoid trying to munge with values in ConfigMaps or Secrets.

@motomux since you reported this issue, I wonder your thoughts.

[derekwaynecarr]

If the secret was created incorrectly say via a kubectl create secret command, then we should fix that bug, but I do not think we should introspect the value of a secret / configmap. what is persisted in the secret value is what the pod should get exactly.

[thockin]

We should not mutate the user's input. Period.

On Thu, Mar 31, 2016 at 11:10 AM, Derek Carr notifications@github.com
wrote:

If the secret was created incorrectly say via a kubectl create secret
command, then we should fix that bug, but I do not think we should
introspect the value of a secret / configmap. what is persisted in the
secret value is what the pod should get exactly.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#23404 (comment)

[motomux]

Thank you for your clarifying it. I didn't know that output of echo has new line character.

I don't think kubectl should change user's input neither, but I think the document about secret should be changed to use echo -n instead of just echo or put some notes since I created secrets like the document and had the issue.

[thockin]

+100 to docs fixes. @pmorie

On Sat, Apr 2, 2016 at 5:39 PM, motomux notifications@github.com wrote:

Thank you for your clarifying it. I didn't know that output of echo has
new line character.

I don't think kubectl should change user's input neither, but I think the
document about secret http://kubernetes.io/docs/user-guide/secrets/
should be changed to use echo -n instead of just echo or put some notes
since I created secrets like the document and had the issue.

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
#23404 (comment)

[pmorie]

@motomux that's a great suggestion. I'll change this for configmap and secret.