Add ability to reference Kubernetes ConfigMap / Secret values from container component

[scottkurz]

Is your feature request related to a problem? Please describe.

As a devfile author, I would like to be able to reference ConfigMap & Secret values defined in the cluster, e.g. a maven repository password.

Describe the solution you'd like

The syntax doesn't fit into the existing devfile schema.

I'd like to see syntax, e.g. like:

Individual variables - Secret

components:
  - name: mycomp
    container:
        env:
        - name: MY_USER
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: user
        - name: MY_PASSWORD
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: password

RELATED VARIANTS

(Starting at JSONPath: components[n].container)

Individual variables - ConfigMap

env:
- name: APP_NAME
  valueFrom:
    configMapKeyRef:
      name: my-app-name
      key: app-name

All variables - Secret

  envFrom:
  - secretRef:
      name: my-secret

All variables - ConfigMap

  envFrom:
  - configMapRef:
      name: my-configmap

Describe alternatives you've considered

• Building passwords into container images creates a level of exposure.

• I guess in theory this function could be pushed onto the specific tools' UI but that seems more cumbersome. Plus it misses the opportunity to capture this as an important descriptive property of the devfile.

• Another approach would be to provide a syntax for "consuming" a secret/configmap value as a "global attribute" (as discussed in: parse plugin component and add component, command and events to the main devfile obj #240). Then for each container env it would simply "consume" the global attr value. I think my suggestion promotes this use case as more of a "first class" scenario so is preferable.

Additional context

I don't understand well enough to appreciate whether this would make sense for another component type besides 'container.... like 'kubernetes'-type or others?

[amisevsk]

I missed this issue when creating #310 but we're talking about similar features (I think).

[scottkurz]

Might be good to support envFrom syntax too:

  envFrom:
  - secretRef:
      name: mysecret

UPDATE: added to original proposal.

[scottkurz]

@elsony do you think we could put this in the 2.2 milestone list?

[elsony]

Community call discussion 3/28:

1. Not part of the devfile 2.2 spec. There are some concerns on including this as part of the devfile will make the devfile only work in certain environments. See https://github.com/devfile/devworkspace-operator/blob/main/docs/additional-configuration.md#automatically-mounting-volumes-configmaps-and-secrets for details on how devWorkspace approach this problem.

[l0rd]

c.f. #1033

[github-actions]

This issue is stale because it has been open for 90 days with no activity. Remove stale label or comment or this will be closed in 60 days.