Challenge, Medium,  on  Kubernetes

Mount a ConfigMap and Secret into a Single Directory Using a Projected Volume

Omkar Shelke
by  Omkar Shelke

Scenario

The exam namespace already has two resources waiting for you:

  • ConfigMap app-config — holds three configuration files: database.conf, cache.conf, and app.properties
  • Secret app-secret — holds three sensitive keys: db-password, api-key, and jwt-secret

A new Pod needs to read all six files from a single directory /etc/app. The security policy requires the mount to be read-only.

Task

  1. Create a Pod named app in the exam namespace using the busybox image with the command sleep 3600.
  2. Define exactly one volume named app-config-vol that combines both app-config (ConfigMap) and app-secret (Secret) into a single volume using a projected volume.
  3. Mount the volume at /etc/app as readOnly.
Kubernetes projected volume combining ConfigMap and Secret into /etc/app

Both the ConfigMap (app-config) and Secret (app-secret) are projected into a single read-only directory (/etc/app) using one projected volume (app-config-vol).

Hint 1 — Why a Normal Volume Won't Work Here

A standard configMap volume or secret volume can only reference one source. If you define two separate volumes and two separate mounts, you will have two directories — not one. The task requires a single volume and a single mount path that surfaces files from both sources simultaneously.

The volume type that solves this is called a projected volume.

Documentation

Hint 2 — Structure of a Projected Volume

A projected volume uses the projected key instead of configMap or secret. Under it, sources accepts a list — each item is either a configMap or a secret block referencing the resource by name. Both are top-level sibling entries in the same sources list:

volumes:
- name: app-config-vol
  projected:
    sources:
    - configMap:
        name: app-config
    - secret:
        name: app-secret

Documentation

Hint 3 — Making the Mount Read-Only

readOnly is set on the volumeMount inside the container spec, not on the volume definition itself. Reference the volume by the exact name app-config-vol and set readOnly: true:

volumeMounts:
- name: app-config-vol
  mountPath: /etc/app
  readOnly: true

After applying, verify with:

kubectl exec app -n exam -- ls /etc/app

Documentation

⚒ Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge mount-configmap-and-secret-using-a-single-volume-df4de738

This will create a local copy of the challenge content in a directory named mount-configmap-and-secret-using-a-single-volume-df4de738. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge mount-configmap-and-secret-using-a-single-volume-df4de738

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge