WEBVTT

00:01.070 --> 00:05.000
Let's go through the lab four secrets.

00:05.930 --> 00:06.900
The first question is,

00:06.900 --> 00:10.640
how many secrets exist on the system
in the default namespace?

00:10.740 --> 00:15.810
We're going to do a kubectl get secrets.

00:18.080 --> 00:21.470
There's just one, so the answer is one.

00:24.760 --> 00:28.830
How many secrets are defined
in the default-token secret?

00:28.830 --> 00:33.530
We're going to do
a kubectl describe secret,

00:37.340 --> 00:39.470
and with the additional details.

00:39.470 --> 00:44.450
Under the data section,
we have multiple details.

00:44.450 --> 00:46.970
We have the ca.crt.
That's one.

00:47.610 --> 00:50.190
Then you have the namespace,
and then you have the token.

00:50.190 --> 00:53.200
This entire text here

00:53.200 --> 00:58.320
is the encoded token, so we have three.

00:59.560 --> 01:01.310
That's the answer for that.

01:03.700 --> 01:06.900
Now, what is the type
of the default-token secret?

01:08.100 --> 01:09.660
The type, as you can see,

01:09.660 --> 01:12.520
it is a kubernetes.io/service-account-token.

01:12.520 --> 01:13.860
That's the type.

01:17.400 --> 01:19.900
Which of the following
is not a secret data

01:19.900 --> 01:21.980
defined in the default-token?

01:21.980 --> 01:26.090
We know that the data is ca.crt,
namespace, and token.

01:26.220 --> 01:28.680
That's namespace, ca.crt, and token.

01:28.830 --> 01:31.240
Type is not a data.

01:32.900 --> 01:35.650
That's the answer to that.

01:37.410 --> 01:40.800
We're going to deploy an application
with the below architecture.

01:41.330 --> 01:44.510
We have already deployed
the required pods and services.

01:44.510 --> 01:46.220
Check out the pods and services created,

01:46.220 --> 01:51.150
and check out the web application
using the Webapp MySQ link above.

01:52.780 --> 01:58.880
Let's first check out the deployment.

01:59.300 --> 02:00.520
There are no deployments.

02:00.520 --> 02:02.000
Let's check pods.

02:02.440 --> 02:03.680
There are two pods.

02:03.680 --> 02:07.470
You have a webapp pod and a MySQL pod.

02:07.470 --> 02:10.720
You have the MySQL pod,
and this is the webapp pod.

02:10.720 --> 02:12.860
Then there are two services.

02:15.050 --> 02:16.730
Let's check services.

02:18.490 --> 02:21.040
This window
is a default Kubernetes service,

02:21.040 --> 02:24.190
but you also have the webapp service,
which happens to be this,

02:24.290 --> 02:26.060
and the SQL01

02:27.900 --> 02:31.290
and SQL01 service,

02:31.560 --> 02:32.990
which happens to be this.

02:34.110 --> 02:35.660
Those are the services.

02:35.770 --> 02:37.620
Then secret.

02:42.780 --> 02:44.410
There's a default token secret,

02:44.410 --> 02:46.780
but that's not the secret
that's used here.

02:47.720 --> 02:50.030
The secret is required
for the webapp application

02:50.030 --> 02:53.180
to connect to the MySQL database.

02:53.720 --> 02:55.320
Let's check the application status.

02:55.320 --> 02:58.380
Here, we can see
that it's in a failed state.

02:58.380 --> 03:01.480
It says failed connecting
to the MySQL database.

03:01.740 --> 03:06.670
The database host is not set,
the DB is not set,

03:07.360 --> 03:09.700
and the password is not set.

03:10.670 --> 03:11.940
That's the error.

03:13.410 --> 03:14.700
Let's proceed.

03:16.420 --> 03:17.960
The reason the application has failed

03:17.960 --> 03:21.330
is because we have not created
the secret object yet.

03:21.420 --> 03:24.420
Let's create a new secret named db-secret

03:24.530 --> 03:25.900
with the data given below.

03:28.320 --> 03:29.620
Let's create a secret.

03:29.620 --> 03:33.870
kubectl create secret

03:33.870 --> 03:35.850
and let's quickly check the help.

03:37.550 --> 03:41.260
When you create a secret,
you have to specify the type of secret.

03:41.260 --> 03:43.480
We're not going to create
a Docker registry or TLS.

03:43.480 --> 03:46.190
We're just going to create
a generic secret.

03:46.660 --> 03:48.680
Let's check the help for that.

03:51.900 --> 03:53.180
Here, we see

03:55.730 --> 04:00.130
the syntax we use to create a secret
is to specify secret generic

04:00.130 --> 04:04.510
and then the name of the secret
followed by the data from a file,

04:04.740 --> 04:09.970
or it could be from multiple files,

04:10.090 --> 04:13.440
or it could just be from literal

04:15.040 --> 04:16.460
just from the command line.

04:16.460 --> 04:18.350
We're going to use this approach

04:18.350 --> 04:20.250
because we have
the information right here.

04:20.450 --> 04:23.300
Let's do that.

04:24.430 --> 04:28.180
Secret generics, don't forget generic.

04:28.380 --> 04:30.850
The name of the secret is db-secret,

04:32.580 --> 04:36.580
and then we have from-literal

04:37.280 --> 04:41.950
=DB_Host=sql01.

04:41.950 --> 04:45.480
Then from literal again,

04:46.000 --> 04:49.370
DB_User=root.

04:52.190 --> 04:54.760
Now, remember that
these are case-sensitive.

04:56.040 --> 05:00.050
Then from literal again and DB_ 

05:01.540 --> 05:06.440
password equals password123.

05:14.140 --> 05:18.270
Let's verify if it's created.

05:20.840 --> 05:25.220
Describe DB secret.

05:25.780 --> 05:27.320
Describe secret,

05:28.320 --> 05:29.870
then DB secret.

05:32.240 --> 05:35.630
We see that it's created
with the data DB_Host,

05:35.630 --> 05:37.580
DB_ User, and DB_Password.

05:40.800 --> 05:42.700
That's a success.

05:43.810 --> 05:46.110
Next is to configure a webapp-pod

05:46.110 --> 05:49.870
to load environment variables
from the newly created secret.

05:55.960 --> 06:00.420
Let's check pod out first.

06:00.420 --> 06:05.150
We have the webapp pod

06:07.630 --> 06:12.340
and currently, there are no secrets

06:15.950 --> 06:19.530
so let's edit the pod.

06:25.680 --> 06:30.510
To add the secret,
but if we don't know how to do that,

06:30.510 --> 06:35.080
let's first review
the Kubernetes documentation pages

06:35.290 --> 06:36.830
and look at secrets.

06:40.490 --> 06:42.100
Let's go to the first one.

06:43.890 --> 06:47.340
We are at the page for secrets.

06:49.310 --> 06:50.820
Here, as you can read,

06:52.350 --> 06:55.790
you must not create secret
as we created just now

06:55.790 --> 06:58.360
to store database credentials
or passwords.

06:58.360 --> 07:03.720
That's because the secret data
is stored in etcd as is

07:03.720 --> 07:05.060
without any encryption.

07:05.060 --> 07:08.540
Anyone who has access to the API server

07:09.390 --> 07:13.320
or the etcd database
can read or even modify the secret.

07:14.120 --> 07:15.870
Must be enabling encryption at rest

07:15.870 --> 07:20.400
or look into enabling
role-based access controls.

07:22.340 --> 07:27.290
Let's go ahead and find information
on configuring the secret for the pod.

07:27.290 --> 07:29.800
You can see that here.

07:30.300 --> 07:31.660
Here you have using a secret

07:31.660 --> 07:36.560
and then you also have
using secrets as environment variables.

07:37.620 --> 07:39.640
There are multiple options here.

07:43.600 --> 07:44.900
Here's one that we could use,

07:44.900 --> 07:48.200
which is the envFrom
what we did for the config map.

07:48.990 --> 07:53.170
We could use the envFrom,
and then specify a secret key reference,

07:53.170 --> 07:56.040
that way,
all the data stored in the secret

07:56.040 --> 07:58.590
is going to be passed through
as environment variable.

07:58.590 --> 07:59.890
Let's copy that.

08:05.760 --> 08:10.970
This is going to go
into the container section.

08:13.870 --> 08:15.530
We can have this anywhere.

08:17.740 --> 08:19.020
Space that.

08:20.640 --> 08:24.660
The key name should be db-secret.

08:32.120 --> 08:33.650
Let's save the file.

08:34.880 --> 08:36.820
I'm going to allow us to edit it.

08:36.820 --> 08:37.620
That's fine.

08:37.620 --> 08:42.930
We're going to quit
and let's do a kubectl replace force

08:49.090 --> 08:50.590
and specify the file.

08:51.150 --> 08:55.640
We'll just wait for the pod
to be deleted and recreated.

08:58.160 --> 08:59.810
Okay.
That's done.

08:59.810 --> 09:04.410
Let's verify the pod.

09:07.850 --> 09:13.060
We see that the environment variables
are right from the db-secret.

09:13.720 --> 09:15.920
Okay, let's check this out.

09:16.680 --> 09:18.530
That's configured correctly.

09:19.780 --> 09:22.600
Let's go back
and review the web application

09:22.600 --> 09:24.300
and we see that is now a success.

09:24.300 --> 09:28.480
It's able to read
the environment variables

09:28.620 --> 09:30.590
as we passed through.

09:33.740 --> 09:37.170
Of course, remember we should not
read passwords and display like this,

09:37.170 --> 09:39.660
but this is a sample application

09:39.660 --> 09:43.740
to prove how secrets can be passed
as environment variables

09:43.740 --> 09:48.620
and this helps us debug
if something is not passed through right.

09:50.160 --> 09:52.110
That's the end of this lab.