fission-src/Documentation/docs-site/content/tutorial/access-secret-cfgmap-in-function.md

title, draft, weight

title	draft	weight
Access secret/configmap in function	false	41

From fission v0.5.0 and later, functions are able to access Secrets and ConfigMaps specified by users.

Create Secret and ConfigMap

You can create Secret and ConfigMap with CLI.

$ kubectl -n default create secret generic foo --from-literal=TEST_KEY="TESTVALUE"
$ kubectl -n default create configmap bar --from-literal=TEST_KEY=TESTVALUE

Or use kubectl create -f <filename.yaml> to create these from a YAML file.

apiVersion: v1
kind: Secret
metadata:
  namespace: default
  name: foo
data:
  TEST_KEY: VEVTVFZBTFVF # value after base64 encode
type: Opaque

---
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: default
  name: bar
data:
  TEST_KEY: TESTVALUE

Access Secret and ConfigMap

Since content of Secret and ConfigMap are key-value pairs, functions can access them with following paths:

# Secret path
/secrets/<namespace>/<name>/<key>

# ConfigMap path
/configs/<namespace>/<name>/<key>

From the previous example, the paths are:

# secret foo
/secrets/default/foo/TEST_KEY

# confimap bar
/configs/default/bar/TEST_KEY

Now, let's create a simple python function (leaker.py) that return value of Secret foo and ConfigMap bar.

# leaker.py

def main():
    path = "/configs/default/bar/TEST_KEY"
    f = open(path, "r")
    config = f.read()

    path = "/secrets/default/foo/TEST_KEY"
    f = open(path, "r")
    secret = f.read()

    msg = "ConfigMap: %s\nSecret: %s" % (config, secret)

    return msg, 200

Create environment, function and http trigger.

# create python env
$ fission env create --name python --image fission/python-env

# create function named "leaker"
$ fission fn create --name leaker --env python --code leaker.py --secret foo --configmap bar

# create route(http trigger)
$ fission route create --function leaker --url /leaker --method GET

Try to access the function, the output should look like following.

$ curl http://$FISSION_ROUTER/leaker
ConfigMap: TESTVALUE
Secret: TESTVALUE

Note: If the Secret or ConfigMap value is updated, the function may not get the updated value for some time; it may get a cached older value.