如何在 Bash 脚本中使用 Kubernetes 的秘密

Question

I have a secret stored in the Kubernetes pod which can be accessible by the following command.

kubectl exec -it pod_name -- printenv | grep SFTP_PASSWORD

which will provide the output as

SFTP_PASSWORD=password

I am accessing this secret in the bash script.

sftp_password=$(kubectl exec -it pod_name -- printenv | grep SFTP_PASSWORD)

But the issue I am facing is the above command will return both key-value pairs instead of value.

Answer 1

If it's an environment variable, you can just use ordinary Bourne shell parameter expansion syntax:

kubectl exec pod_name -- sh -c 'echo $SFTP_PASSWORD'

Note the single quotes, to prevent the local shell from expanding the parameter; the sh -c wrapper so that a remote shell will be started to do the parameter expansion; and in this non-interactive use the -it options are unnecessary.

It's possible your cluster administrator prohibits kubectl exec , to prevent copying secret values out of the cluster in exactly this way. This also avoids the non-standard printenv tool (it is part of GNU Coreutils and not the POSIX spec, so Alpine-based images may not have it).