Add secrets to runtime configuration

[sepetrov]

Issue Ref: None

Description:

Adds support for using secrets via mounted volumes.

Extends the runtime-images structure in kubeless-config configmap to allow using secrets in the init containers of function deployments, in a similar way as providing environment variables.

Usage:

Manifest for github-token secret.

apiVersion: v1
kind: Secret
metadata:
  name: github-token
type: Opaque
stringData:
  token: foobar

Manifest for kubeless-config configmap

...
data:
  runtime-images: |
    [
        {
            "ID": "go",
            "depName": "go.mod",
            "fileNameSuffix": ".go",
            "versions": [
                {
                    "imagePullSecrets": [{"ImageSecret": "docker-registry"}],
                    "images": [
                        {
                            "command": "docker-entrypoint",
                            "env": {
                                "GITHUB_TOKEN_SECRET_FILE": "/var/run/secrets/kubeless.io/github-token/token",
                                "GOCACHE": "$(KUBELESS_INSTALL_VOLUME)/.cache",
                                "GOPRIVATE": "github.com/acme/*"
                            },
                            "image": "quay.io/acme/kubeless-runtime:go-1.14",
                            "phase": "compilation",
                            "secrets": [{"name": "github-token"}]
                        },
                        {
                            "image": "kubeless/go@sha256:55759228714d7080b3dd858e56530d4e1f539d071906e88d88b454ee3b3c9b16",
                            "phase": "runtime"
                        }
                    ],
                    "name": "go1.14",
                    "version": "1.14"
                }
            ]
        }
    ]
...

The above runtime configuration specified custom image for Go 1.14 runtime with a secret github-token shared with the container as a volume mounted at /var/run/secrets/kubeless.io/{{secret.name}} (/var/run/secrets/kubeless.io/github-token in this example). Now the container can read the GitHub token secret from the filesystem and use it to download private Go packages.

TODOs:

• Ready to review
• Automated Tests
• Docs

[andresmgot]

Thanks for the feature! I have a couple of minor comments.

[andresmgot]

you need to use an unused subpath like "/etc/secrets/" + secret.Name so you avoid issues with people using as secret name var or run

[sepetrov]

Hi @andresmgot , I agree completely, mounting in the root is not ideal - I went for it as a first iteration + AFAIK serverless-kubeless plugin is using this approach.

I am thinking of the following options:

1. /var/run/secrets/{{secret.name}}
2. /var/run/secrets/kubeless.io/{{secret.name}}
3. /opt/secrets/{{secret.name}}
4. /opt/secrets/kubeless.io/{{secret.name}}

My choice would be 2. Seems consistent with what I see as mounted volumes with secrets in kubernetes.

What do you think?

[sepetrov]

Changed mount path to /var/run/secrets/kubeless.io/{{secret.name}}.

[andresmgot]

I would add here the path in which the secrets are mounted.

[sepetrov]

Added

[andresmgot]

Thanks for the changes!