Podman kube play support for "secret.items" like configMaps

[rahman-duran]

Feature request description

With Kubernetes secrets, we can mount only specific keys in secrets, just like we can do with Kubernetes ConfigMaps. Here is a doc from "https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/configuration/secret/":

"If spec.volumes[].secret.items is used, only keys specified in items are projected. To consume all keys from the secret, all of them must be listed in the items field. All listed keys must exist in the corresponding secret. Otherwise, the volume is not created."

But this is not working even in Podman 4.4.1. Podman mounts the whole secrets keys as files, even when we define only one "item":

` volumeMounts:
- mountPath: /private/secrets/
name: dataprotection-cert
readOnly: true
........

volumes:
- name: dataprotection-cert
secret:
secretName: test_secrets
items:
- key: dp_cert
path: dataprotection-cert.pem
`

With this yaml, Podman should only mount single file: "/private/secrets/dataprotection-cert.pem" but it does not regard "items" section and it mounts whole keys in "test_secrets" into "/private/secrets"

When I look at the code in "volume.go", "VolumeFromConfigMap()" function has a section that process the "items" but "VolumeFromSecret()" function does not check "items", as far as I see.

Suggest potential solution

Support secret.items just like configMap.items

Have you considered any alternatives?

no

Additional context

No response

[rhatdan]

@umohnani8 thoughts?

[umohnani8]

yup, items should be used when specified for secrets as well. Opened #17995 to fix this.