Add YAML section to the SECRETS.md
**What**
Add a new section explaining how to use k8s secrets with the yaml
stack file
## Managing Secrets
Secrets come in two flavors, image-pull secrets and application secrets.
+
1. Image-pull secrets that [Kubernetes will use to pull Docker images from a private registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
2. Application secrets are simply sensitive values that your function requires to function, e.g. a database password. `faas-netes` supports both types of secrets.
+
If you are familiar with the inner workings of Kubernetes, then image-pull secrets will be used as you would expect from the Kubernetes documentation. In contrast, application secrets will behave in the same way that secrets are handled in Docker Swarm, specifically, they will be mounted as files in the `/run/secrets` folder. This allows your functions to be agnostic of the deployment infrastructure. The relevant Kubernetes documentation for how this is implemented can be found [here](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod).
_Note_: You can transparently use both types of secrets simultaneously for a function. `faas-netes` will gracefully inspect and handle secrets of different types.
@@ -47,7 +49,6 @@ curl -X POST -d \
Now update the function to use the new secret:
-
```
curl -X POST -d \
'{"image": "alexellis2/private-alpine:latest", "envProcess": "sha512sum", "service": "shametoo", "secrets": ["dockerhub"]}' $(minikube ip):31111/system/functions
@@ -58,6 +59,7 @@ You will now see that your function from a private registry has been deployed.
## Application Secrets
### Create a secret
+
Consider a function that requires access to a database and that you have store the username and password credentials in `dbusername.txt` and `dbpass.txt`. Using the Kuberenetes documentation as a basis, we can create a secret in Kubernetes
```sh
@@ -74,4 +76,30 @@ curl -X POST -d \
'{"image": "yourexample/db-fnc-alpine:latest", "envProcess": "./secretFunc", "service": "secret-func", "secrets": ['db-user-pass']}' $(minikube ip):31111/system/functions
```
+## Secrets in the YAML stack file
+
+Using Kubernetes secrets in your OpenFaaS stack file is easy, you only need to list the secrets you want to use and OpenFaaS will attach them for you.
+
+For example, we can combine the ideas from the previous sections and assume you have a function that
+
+1. requires a database password, _and_
+2. is in a private Docker Hub repository.
+
+After adding your secrets to Kubernetes like you did in the previous sections, your stack file would look like
+
+```yaml
+provider:
+ name: faas
+ gateway: http://localhost:8080
+
+functions:
+ protectedapi:
+ lang: Dockerfile
+ skip_build: true
+ image: username/private-alpine:latest
+ secrets:
+ - db-user-pass
+ - dockerhub
+```
+Notice that you do not need to do anything special to indicate the type of each secret. OpenFaaS will infer that the `dockerhub` is an Image Pull Secret automatically.
