You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+30-29
Original file line number
Diff line number
Diff line change
@@ -42,17 +42,17 @@ spec:
42
42
args: ["start"]
43
43
# A 1Password Connect server will inject secrets into this application.
44
44
env:
45
-
- name: OP_CONNECT_HOST
46
-
value: http://onepassword-connect:8080
47
-
- name: OP_CONNECT_TOKEN
48
-
valueFrom:
49
-
secretKeyRef:
50
-
name: connect-token
51
-
key: token
52
-
- name: DB_USERNAME
53
-
value: op://my-vault/my-item/sql/username
54
-
- name: DB_PASSWORD
55
-
value: op://my-vault/my-item/sql/password
45
+
- name: OP_CONNECT_HOST
46
+
value: http://onepassword-connect:8080
47
+
- name: OP_CONNECT_TOKEN
48
+
valueFrom:
49
+
secretKeyRef:
50
+
name: connect-token
51
+
key: token
52
+
- name: DB_USERNAME
53
+
value: op://my-vault/my-item/sql/username
54
+
- name: DB_PASSWORD
55
+
value: op://my-vault/my-item/sql/password
56
56
57
57
- name: my-app # my-app isn't listed in the inject annotation above, so secrets won't be injected into this container.
58
58
image: my-image
@@ -61,10 +61,10 @@ spec:
61
61
command: ["npm"]
62
62
args: ["start"]
63
63
env:
64
-
- name: DB_USERNAME
65
-
value: op://my-vault/my-item/sql/username
66
-
- name: DB_PASSWORD
67
-
value: op://my-vault/my-item/sql/password
64
+
- name: DB_USERNAME
65
+
value: op://my-vault/my-item/sql/username
66
+
- name: DB_PASSWORD
67
+
value: op://my-vault/my-item/sql/password
68
68
```
69
69
70
70
<details>
@@ -98,15 +98,15 @@ spec:
98
98
args: ["start"]
99
99
# A 1Password Service Account will inject secrets into this application.
100
100
env:
101
-
- name: OP_SERVICE_ACCOUNT_TOKEN
102
-
valueFrom:
103
-
secretKeyRef:
104
-
name: op-service-account
105
-
key: token
106
-
- name: DB_USERNAME
107
-
value: op://my-vault/my-item/sql/username
108
-
- name: DB_PASSWORD
109
-
value: op://my-vault/my-item/sql/password
101
+
- name: OP_SERVICE_ACCOUNT_TOKEN
102
+
valueFrom:
103
+
secretKeyRef:
104
+
name: op-service-account
105
+
key: token
106
+
- name: DB_USERNAME
107
+
value: op://my-vault/my-item/sql/username
108
+
- name: DB_PASSWORD
109
+
value: op://my-vault/my-item/sql/password
110
110
111
111
- name: my-app # my-app isn't listed in the inject annotation above, so secrets won't be injected into this container.
112
112
image: my-image
@@ -115,17 +115,18 @@ spec:
115
115
command: ["npm"]
116
116
args: ["start"]
117
117
env:
118
-
- name: DB_USERNAME
119
-
value: op://my-vault/my-item/sql/username
120
-
- name: DB_PASSWORD
121
-
value: op://my-vault/my-item/sql/password
118
+
- name: DB_USERNAME
119
+
value: op://my-vault/my-item/sql/username
120
+
- name: DB_PASSWORD
121
+
value: op://my-vault/my-item/sql/password
122
122
```
123
123
124
124
</details>
125
125
126
126
To inject secrets, the Pod you're looking to inject into must have a `command` value defined in its [Deployment or Pod spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#container-v1-core). The 1Password Secrets Injector works by mutating the this value on initilization, and as such a command is needed to be mutated. If the deployments you're using aren't designed to have `command` specified in the deployment, then the 1Password Kubernetes Operator may be a better fit for your use case.
127
127
128
-
**Note:** Injected secrets are available _only_ in the current pod's session. In other words, the secrets will only be accessible for the command listed in the container specification. To access it in any other session, for example using `kubectl exec`, it's necessary to prepend `op run --` to the command.
128
+
**Note:** Injected secrets are available *only* in the current pod's session. In other words, the secrets will only be accessible for the command listed in the container specification. To access it in any other session, for example using `kubectl exec`, it's necessary to prepend `op run --` to the command.
129
+
129
130
130
131
In the example above the `app-example1` container will have injected the `DB_USERNAME` and `DB_PASSWORD` values in the session executed by the command `npm start`.
0 commit comments