{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/3072","labels_url":"https://api.github.com/repos/openshift/origin/issues/3072/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3072/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/3072/events","html_url":"https://github.com/openshift/origin/issues/3072","id":87107241,"number":3072,"title":"boot2docker issues mounting secrets","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/component/auth","name":"component/auth","color":"0052cc"},{"url":"https://api.github.com/repos/openshift/origin/labels/kind/bug","name":"kind/bug","color":"fc2929"},{"url":"https://api.github.com/repos/openshift/origin/labels/priority/P1","name":"priority/P1","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"comments":18,"created_at":"2015-06-10T21:05:46Z","updated_at":"2015-06-12T20:09:48Z","closed_at":"2015-06-12T18:13:51Z","body":"When we started using secrets for deployments, we noticed that containers are not able to read mounted secrets.\r\n\r\nThe pod definitions contain Volume and VolumeMount definintions, and `docker inspect` shows the volumes as expected, but the container cannot read files from the mount point.\r\n\r\nThis surfaces (in the case of the deployer pod) as this error:\r\n```\r\nF0610 18:32:48.935073       1 deployer.go:65] User \"system:anonymous\" cannot get replicationcontrollers in project \"myproject\"\r\n```\r\n\r\n`docker inspect <container>` shows the volume mount:\r\n```\r\n...\r\n        \"Env\": [\r\n...\r\n            \"BEARER_TOKEN_FILE=/var/run/secrets/kubernetes.io/serviceaccount/token\",\r\n...\r\n    \"HostConfig\": {\r\n        \"Binds\": [\r\n            \"/openshift.local.volumes/pods/12f168c2-0fad-11e5-a1f9-525400553cbb/volumes/kubernetes.io~secret/deployer-token-2jxjw:/var/run/secrets/kubernetes.io/serviceaccount:ro\",\r\n...\r\n        ],\r\n...\r\n    \"Volumes\": {\r\n...\r\n        \"/var/run/secrets/kubernetes.io/serviceaccount\": \"/openshift.local.volumes/pods/12f168c2-0fad-11e5-a1f9-525400553cbb/volumes/kubernetes.io~secret/deployer-token-2jxjw\"\r\n    },\r\n    \"VolumesRW\": {\r\n...\r\n        \"/var/run/secrets/kubernetes.io/serviceaccount\": false\r\n    },\r\n    \"VolumesRelabel\": {\r\n...\r\n        \"/var/run/secrets/kubernetes.io/serviceaccount\": \"ro\"\r\n    }\r\n...\r\n```"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/111602097","html_url":"https://github.com/openshift/origin/issues/3072#issuecomment-111602097","issue_url":"https://api.github.com/repos/openshift/origin/issues/3072","id":111602097,"user":{"login":"gravis","id":12752,"avatar_url":"https://avatars.githubusercontent.com/u/12752?v=3","gravatar_id":"","url":"https://api.github.com/users/gravis","html_url":"https://github.com/gravis","followers_url":"https://api.github.com/users/gravis/followers","following_url":"https://api.github.com/users/gravis/following{/other_user}","gists_url":"https://api.github.com/users/gravis/gists{/gist_id}","starred_url":"https://api.github.com/users/gravis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gravis/subscriptions","organizations_url":"https://api.github.com/users/gravis/orgs","repos_url":"https://api.github.com/users/gravis/repos","events_url":"https://api.github.com/users/gravis/events{/privacy}","received_events_url":"https://api.github.com/users/gravis/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T20:09:48Z","updated_at":"2015-06-12T20:09:48Z","body":"`mount` is available in the container:\r\n\r\n```\r\n[root@boot2docker openshift]# ls /usr/bin/mount\r\n/usr/bin/mount\r\n[root@boot2docker openshift]# which mount\r\n/usr/bin/mount\r\n```\r\n\r\n"}}