github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-30 06:54:01 +00:00
Code Issues Projects Releases Wiki Activity

Document what happens when pod uses nonexistent secret.

Browse Source
This commit is contained in:
Eric Tune 2015-05-28 17:02:54 -07:00
parent f6ecb28c06
commit c11127c9a6
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/secrets.md
View File

@ -83,14 +83,23 @@ versions of Kubernetes are expected to provide more automation for populating
environment variables from files.
## Changes to Secrets
## Secret and Pod Lifetime interaction
Once a pod is created, its secret volumes will not change, even if the secret
resource is modified. To change the secret used, the original pod must be
deleted, and a new pod (perhaps with an identical PodSpec) must be created.
Therefore, updating a secret follows the same workflow as deploying a new
container image. The `kubectl rolling-update` command can be used ([man
page](kubectl_rolling-update.md)).
When a pod is created via the API, there is no check whether a referenced
secret exists. Once a pod is scheduled, the kubelet will try to fetch the
secret value. If the secret cannot be fetched because it does not exist or
because of a temporary lack of connection to the API server, kubelet will
periodically retry. It will report an event about the pod explaining the
reason it is not started yet. Once the a secret is fetched, the kubelet will
create and mount a volume containing it. None of the pod's containers will
start until all the pod's volumes are mounted.
Once the kubelet has started a pod's containers, its secret volumes will not
change, even if the secret resource is modified. To change the secret used,
the original pod must be deleted, and a new pod (perhaps with an identical
PodSpec) must be created. Therefore, updating a secret follows the same
workflow as deploying a new container image. The `kubectl rolling-update`
command can be used ([man page](kubectl_rolling-update.md)).
The resourceVersion of the secret is not specified when it is referenced.
Therefore, if a secret is updated at about the same time as pods are starting,