In Open Liberty, configuration of datasource credentials is typically done in the server.xml file. If we use containers and container orchestration, we ideally make use of Infrastructure-as-Code and store all configuration under version control. However, this is certainly not desired for these datasource credentials. For that reason, Kubernetes secret definitions allow us to separately store secret values that shouldn’t be visible to everyone in our clusters.
In Open Liberty we can define an optional bootstrap.properties file which defines properties that are read before the server.xml configuration and thus can affect configuration behavior. We use this file to define the credentials to our datasource:
coffee-shop.db.username=postgres coffee-shop.db.password=postgres
However, this file will not be included into our Docker image but injected into the container at runtime, by Kubernetes secrets, for example.
These properties then can be referenced in our server.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<server description="Java EE 8 Server">
...
<dataSource id="DefaultDataSource" jdbcDriverRef="postgresql-driver"
type="javax.sql.ConnectionPoolDataSource" transactional="true">
<properties serverName="coffee-shop-db" portNumber="5432"
databaseName="postgres"
user="${coffee-shop.db.username}"
password="${coffee-shop.db.password}"/>
</dataSource>
...
</server>In order to inject the bootstrap.properties file into our running container we define a deployment volume that is populated from a Kubernetes secret:
kind: Deployment
apiVersion: apps/v1beta1
metadata:
name: coffee-shop
spec:
# ...
containers:
- name: coffee-shop
image: ...
volumeMounts:
- name: database-credentials-volume
mountPath: /opt/wlp/usr/servers/defaultServer/bootstrap.properties
subPath: bootstrap.properties
readOnly: true
volumes:
- name: database-credentials-volume
secret:
secretName: database-credentialsThis requires a Kubernetes secret database-credentials which contains the contents of the bootstrap.properties file under the same key name. The properties are then loaded from the bootstrap file at server start-up time.
For further information on Open Liberty configuration, have a look at the documentation.
| Published on Java Code Geeks with permission by Sebastian Daschner, partner at our JCG program. See the original article here: Configuring Open Liberty Datasources via Kubernetes Secrets Opinions expressed by Java Code Geeks contributors are their own. |
