spring.cloud.kubernetes
addition to or instead of the mechanism described earlier.
Multiple (exact) file paths can be specified in spring.cloud.kubernetes.config.paths by using the , delimiterTable 4.1. Properties:
Name Type Default Description spring.cloud.kubernetes.config.enableApi
Boolean
true
Enable/Disable consuming ConfigMaps via APIs
spring.cloud.kubernetes.config.enabled
Boolean
true
Enable Secrets PropertySource
spring.cloud.kubernetes.config.name
String
${spring.application.name}
Sets the name of ConfigMap to lookup
spring.cloud.kubernetes.config.namespace
String
Client namespace
Sets the Kubernetes namespace where to lookup
spring.cloud.kubernetes.config.paths
List
null
Sets the paths where ConfigMaps are mounted
Kubernetes has the notion of [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for storing
sensitive data such as password, OAuth tokens, etc. This project provides integration with Secrets to make secrets
-accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.
The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources:
-1. reading recursively from secrets mounts
-2. named after the application (as defined by spring.application.name)
-3. matching some labels
Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons
- and it is recommend that containers share secrets via mounted volumes. Otherwise proper RBAC security configurations must be provided
- to make sure that unauthorized access to Secrets occurs.
If the secrets are found their data is made available to the application.
Example:
Let’s assume that we have a spring boot application named demo that uses properties to read its database
+accessible by Spring Boot applications. This feature can be explicitly enabled/disabled using the spring.cloud.kubernetes.secrets.enabled property.
The SecretsPropertySource when enabled will lookup Kubernetes for Secrets from the following sources:
- reading recursively from secrets mounts
- named after the application (as defined by
spring.application.name) - matching some labels
Please note that by default, consuming Secrets via API (points 2 and 3 above) is not enabled for security reasons
+and it is recommended that containers share secrets via mounted volumes.
+If you enable consuming Secrets via API, then it is recommended access to Secrets is limited by an
+[authorization policy such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).
If the secrets are found their data is made available to the application.
Example:
Let’s assume that we have a spring boot application named demo that uses properties to read its database
configuration. We can create a Kubernetes secret using the following command:
oc create secret generic db-secret --from-literal=username=user --from-literal=password=p455w0rd
This would create the following secret (shown using oc get secrets db-secret -o yaml):
apiVersion: v1
data:
password: cDQ1NXcwcmQ=
@@ -159,7 +157,7 @@ configuration. We can create a Kubernetes secret using the following command:`
-Dspring.cloud.kubernetes.secrets.labels.broker=activemq
-Dspring.cloud.kubernetes.secrets.labels.db=postgresql
-`
Table 4.2. Properties:
Name Type Default Description spring.cloud.kubernetes.secrets.enableApi
Boolean
false
Enable/Disable consuming secrets via APIs (examples 2 and 3)
spring.cloud.kubernetes.secrets.enabled
Boolean
true
Enable Secrets PropertySource
spring.cloud.kubernetes.secrets.name
String
${spring.application.name}
Sets the name of the secret to lookup
spring.cloud.kubernetes.secrets.namespace
String
Client namespace
Sets the Kubernetes namespace where to lookup
spring.cloud.kubernetes.secrets.labels
Map
null
Sets the labels used to lookup secrets
spring.cloud.kubernetes.secrets.paths
List
null
Sets the paths where secrets are mounted (example 1)
Notes:
+
`Table 4.2. Properties:
| Name | Type | Default | Description |
|---|---|---|---|
spring.cloud.kubernetes.secrets.enableApi | Boolean | false | Enable/Disable consuming secrets via APIs (examples 2 and 3) |
spring.cloud.kubernetes.secrets.enabled | Boolean | true | Enable Secrets PropertySource |
spring.cloud.kubernetes.secrets.name | String | ${spring.application.name} | Sets the name of the secret to lookup |
spring.cloud.kubernetes.secrets.namespace | String | Client namespace | Sets the Kubernetes namespace where to lookup |
spring.cloud.kubernetes.secrets.labels | Map | null | Sets the labels used to lookup secrets |
spring.cloud.kubernetes.secrets.paths | List | null | Sets the paths where secrets are mounted (example 1) |
Notes:
- The property spring.cloud.kubernetes.secrets.labels behaves as defined by
Map-based binding.
- The property spring.cloud.kubernetes.secrets.paths behaves as defined by
@@ -209,6 +207,6 @@ The view role on the service account is required in
- polling: re-creates the configuration periodically from config maps and secrets to see if it has changed.
The polling period can be configured using the property spring.cloud.kubernetes.reload.period and defaults to 15 seconds.
It requires the same role as the monitored property source.
-This means, for example, that using polling on file mounted secret sources does not require particular privileges.
Table 4.3. Properties:
| Name | Type | Default | Description |
|---|---|---|---|
spring.cloud.kubernetes.reload.period | Duration | 15s | The period for verifying changes when using the polling strategy |
spring.cloud.kubernetes.reload.enabled | Boolean | false | Enables monitoring of property sources and configuration reload |
spring.cloud.kubernetes.reload.monitoring-config-maps | Boolean | true | Allow monitoring changes in config maps |
spring.cloud.kubernetes.reload.monitoring-secrets | Boolean | false | Allow monitoring changes in secrets |
spring.cloud.kubernetes.reload.strategy | Enum | refresh | The strategy to use when firing a reload (refresh, restart_context, shutdown) |
spring.cloud.kubernetes.reload.mode | Enum | event | Specifies how to listen for changes in property sources (event, polling) |
Notes: +This means, for example, that using polling on file mounted secret sources does not require particular privileges.
Table 4.3. Properties:
| Name | Type | Default | Description |
|---|---|---|---|
spring.cloud.kubernetes.reload.period | Duration | 15s | The period for verifying changes when using the polling strategy |
spring.cloud.kubernetes.reload.enabled | Boolean | false | Enables monitoring of property sources and configuration reload |
spring.cloud.kubernetes.reload.monitoring-config-maps | Boolean | true | Allow monitoring changes in config maps |
spring.cloud.kubernetes.reload.monitoring-secrets | Boolean | false | Allow monitoring changes in secrets |
spring.cloud.kubernetes.reload.strategy | Enum | refresh | The strategy to use when firing a reload (refresh, restart_context, shutdown) |
spring.cloud.kubernetes.reload.mode | Enum | event | Specifies how to listen for changes in property sources (event, polling) |
Notes: - Properties under spring.cloud.kubernetes.reload. should not be used in config maps or secrets: changing such properties at runtime may lead to unexpected results; - Deleting a property or the whole config map does not restore the original state of the beans when using the refresh level.