{"action":"created","comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/27336288","id":27336288,"diff_hunk":"@@ -0,0 +1,336 @@\n+# Secrets \n+\n+Objects of type `secret` are intended to hold sensitive information, such as\n+passwords, OAuth tokens, and ssh keys.  Putting this information in a `secret`\n+is safer and more flexible than putting it verbatim in a `pod` definition or in\n+a docker image. \n+\n+### Creating and Using Secrets\n+To make use of secrets requires at least two steps:\n+  1. create a `secret` resource with secret data\n+  1. create a pod that has a volume of type `secret` and a container\n+     which mounts that volume.\n+\n+This is an example of a simple secret, in json format:\n+```json\n+{\n+  \"apiVersion\": \"v1beta3\",\n+  \"kind\": \"Secret\",\n+  \"name\": \"mysecret\",\n+  \"namespace\": \"myns\",\n+  \"data\": {\n+    \"username\": \"dmFsdWUtMQ0K\",\n+    \"password\": \"dmFsdWUtMg0KDQo=\"\n+    }\n+}\n+```\n+\n+The data field is a map.\n+Its keys must match [DNS_SUBDOMAIN](docs/design/identifiers.md).\n+The values are arbitrary data, encoded using base64.\n+\n+This is an example of a pod that uses a secret, in json format:\n+```json\n+{\n+  \"apiVersion\":\"v1beta3\",\n+  \"name\": \"mypod\",\n+  \"kind\": \"Pod\",\n+  \"spec\": {\n+    \"manifest\": {\n+      \"containers\": [{\n+        \"name\": \"c\",\n+        \"image\": \"example/image\",\n+        \"volumeMounts\": [{\n+          \"name\": \"foo\",\n+          \"mountPath\": \"/etc/foo\",\n+          \"readOnly\": true\n+        }]\n+      }],\n+      \"volumes\": [{\n+        \"name\": \"foo\",\n+        \"source\": {\n+          \"secret\": {\n+            \"secretName\": \"mysecret\"\n+          }\n+        }\n+      }]\n+    }\n+  }\n+}]\n+```\n+\n+### Restrictions\n+Secret volume sources are validated to ensure that the specified object\n+reference actually points to an object of type `Secret`.  Therefore, a secret\n+needs to be created before any pods that depend on it.\n+\n+Secret API objects reside in a namespace.   They can only be referenced by pods\n+in that same namespace.\n+\n+Individual secrets are limited to 1MB in size.  This is to discourage creation\n+of very large secrets which would exhaust apiserver and kubelet memory.\n+However, creation of many smaller secrets could also exhaust memory.  More\n+comprehensive limits on memory usage due to secrets is a planned feature.\n+\n+### Consuming Secret Values\n+\n+The program in a container is responsible for reading the secret(s) from the\n+files.  Currently, if a program expects a secret to be stored in an environment\n+variable, then the user needs to modify the image to populate the environment\n+variable from the file as an step before running the main program.  Future\n+versions of Kubernetes are expected to provide more automation for populating\n+enviroment variables from files.\n+\n+\n+## Changes to Secrets\n+\n+Once a pod is created, its secret volumes will not change, even if the secret\n+resource is modified.  To change the secret used, the original pod must be\n+deleted, and a new pod (perhaps with an identical PodSpec) must be created.\n+Therefore, updating a secret follows the same workflow as deploying a new\n+container image.  The `kubectl rollingupdate` command can be used ([man\n+page](kubectl-rollingupdate.md)).\n+\n+The resourceVersion of the secret is not specified when it is referenced.\n+Therefore, if a secret is updated at about the same time as pods are starting,\n+then it is not defined which version of the secret will be used for the pod. It\n+is not possible currently to check what resource version of a secret object was\n+used when a pod was created.  It is planned that pods will report this\n+information, so that a controller could restart ones using a old\n+resourceVersion.  In the interim, if this is a concern, it is recommended to not\n+update the data of existing secrets, but to create new ones with distinct names.\n+\n+## Use cases\n+\n+### Use-Case: Pod with ssh keys\n+\n+To create a pod that uses an ssh key stored as a secret, we first need to create a secret:\n+\n+```json\n+{\n+  \"apiVersion\": \"v1beta2\",\n+  \"kind\": \"Secret\",\n+   \"id\": \"ssh-key-secret\",\n+  \"data\": {\n+    \"id-rsa.pub\": \"dmFsdWUtMQ0K\",\n+    \"id-rsa\": \"dmFsdWUtMg0KDQo=\"\n+  }\n+}\n+```\n+\n+**Note:** The serialized JSON and YAML values of secret data are encoded as\n+base64 strings.  Newlines are not valid within these strings and must be\n+omitted.\n+\n+Now we can create a pod which references the secret with the ssh key and\n+consumes it in a volume:\n+\n+```json\n+{\n+  \"id\": \"secret-test-pod\",\n+  \"kind\": \"Pod\",\n+  \"apiVersion\":\"v1beta2\",\n+  \"labels\": {\n+    \"name\": \"secret-test\"\n+  },\n+  \"desiredState\": {\n+    \"manifest\": {\n+      \"version\": \"v1beta1\",\n+      \"id\": \"secret-test-pod\",\n+      \"containers\": [{\n+        \"name\": \"ssh-test-container\",\n+        \"image\": \"mySshImage\",\n+        \"volumeMounts\": [{\n+          \"name\": \"secret-volume\",\n+          \"mountPath\": \"/etc/secret-volume\",\n+          \"readOnly\": true\n+        }]\n+      }],\n+      \"volumes\": [{\n+        \"name\": \"secret-volume\",\n+        \"source\": {\n+          \"secret\": {\n+            \"secretName\": \"mysecret\"","path":"docs/secrets.md","position":153,"original_position":153,"commit_id":"d4341fd38dd167248eb77912a9db6c7df6c5a575","original_commit_id":"d4341fd38dd167248eb77912a9db6c7df6c5a575","user":{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},"body":"Shouldn't the secretName be `ssh-key-secret` instead of `mysecret`?","created_at":"2015-03-27T22:41:09Z","updated_at":"2015-03-27T22:41:09Z","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560#discussion_r27336288","pull_request_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560","_links":{"self":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/27336288"},"html":{"href":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560#discussion_r27336288"},"pull_request":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560"}}},"pull_request":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560","id":31361467,"html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560","diff_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560.diff","patch_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560.patch","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5560","number":5560,"state":"open","locked":false,"title":"Secrets doc","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-03-17T18:02:58Z","updated_at":"2015-03-27T22:41:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e59a615d6bb5800b043f76ba839dcd51f477f0a1","assignee":{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560/commits","review_comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560/comments","review_comment_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5560/comments","statuses_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/d4341fd38dd167248eb77912a9db6c7df6c5a575","head":{"label":"erictune:secrets_doc","ref":"secrets_doc","sha":"d4341fd38dd167248eb77912a9db6c7df6c5a575","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"repo":{"id":21629362,"name":"kubernetes","full_name":"erictune/kubernetes","owner":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/erictune/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/erictune/kubernetes","forks_url":"https://api.github.com/repos/erictune/kubernetes/forks","keys_url":"https://api.github.com/repos/erictune/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/erictune/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/erictune/kubernetes/teams","hooks_url":"https://api.github.com/repos/erictune/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/erictune/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/erictune/kubernetes/events","assignees_url":"https://api.github.com/repos/erictune/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/erictune/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/erictune/kubernetes/tags","blobs_url":"https://api.github.com/repos/erictune/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/erictune/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/erictune/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/erictune/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/erictune/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/erictune/kubernetes/languages","stargazers_url":"https://api.github.com/repos/erictune/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/erictune/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/erictune/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/erictune/kubernetes/subscription","commits_url":"https://api.github.com/repos/erictune/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/erictune/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/erictune/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/erictune/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/erictune/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/erictune/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/erictune/kubernetes/merges","archive_url":"https://api.github.com/repos/erictune/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/erictune/kubernetes/downloads","issues_url":"https://api.github.com/repos/erictune/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/erictune/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/erictune/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/erictune/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/erictune/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/erictune/kubernetes/releases{/id}","created_at":"2014-07-08T21:00:59Z","updated_at":"2015-03-27T18:55:20Z","pushed_at":"2015-03-27T18:55:17Z","git_url":"git://github.com/erictune/kubernetes.git","ssh_url":"git@github.com:erictune/kubernetes.git","clone_url":"https://github.com/erictune/kubernetes.git","svn_url":"https://github.com/erictune/kubernetes","homepage":null,"size":40195,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"GoogleCloudPlatform:master","ref":"master","sha":"50452994cb043c7b29ea286af06177012a4e5847","user":{"login":"GoogleCloudPlatform","id":2810941,"avatar_url":"https://avatars.githubusercontent.com/u/2810941?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCloudPlatform","html_url":"https://github.com/GoogleCloudPlatform","followers_url":"https://api.github.com/users/GoogleCloudPlatform/followers","following_url":"https://api.github.com/users/GoogleCloudPlatform/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCloudPlatform/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCloudPlatform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCloudPlatform/subscriptions","organizations_url":"https://api.github.com/users/GoogleCloudPlatform/orgs","repos_url":"https://api.github.com/users/GoogleCloudPlatform/repos","events_url":"https://api.github.com/users/GoogleCloudPlatform/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCloudPlatform/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"GoogleCloudPlatform/kubernetes","owner":{"login":"GoogleCloudPlatform","id":2810941,"avatar_url":"https://avatars.githubusercontent.com/u/2810941?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCloudPlatform","html_url":"https://github.com/GoogleCloudPlatform","followers_url":"https://api.github.com/users/GoogleCloudPlatform/followers","following_url":"https://api.github.com/users/GoogleCloudPlatform/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCloudPlatform/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCloudPlatform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCloudPlatform/subscriptions","organizations_url":"https://api.github.com/users/GoogleCloudPlatform/orgs","repos_url":"https://api.github.com/users/GoogleCloudPlatform/repos","events_url":"https://api.github.com/users/GoogleCloudPlatform/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCloudPlatform/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/GoogleCloudPlatform/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes","forks_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/forks","keys_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/teams","hooks_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/events","assignees_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/tags","blobs_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/languages","stargazers_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/subscription","commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/merges","archive_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/downloads","issues_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/releases{/id}","created_at":"2014-06-06T22:56:04Z","updated_at":"2015-03-27T22:40:36Z","pushed_at":"2015-03-27T22:40:36Z","git_url":"git://github.com/GoogleCloudPlatform/kubernetes.git","ssh_url":"git@github.com:GoogleCloudPlatform/kubernetes.git","clone_url":"https://github.com/GoogleCloudPlatform/kubernetes.git","svn_url":"https://github.com/GoogleCloudPlatform/kubernetes","homepage":"http://kubernetes.io","size":118232,"stargazers_count":6777,"watchers_count":6777,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1293,"mirror_url":null,"open_issues_count":830,"forks":1293,"open_issues":830,"watchers":6777,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560"},"html":{"href":"https://github.com/GoogleCloudPlatform/kubernetes/pull/5560"},"issue":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5560"},"comments":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5560/comments"},"review_comments":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560/comments"},"review_comment":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/5560/commits"},"statuses":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/d4341fd38dd167248eb77912a9db6c7df6c5a575"}}}}