Is it possible for 2 containers inside a Pod to share the same Environment Variables?

Question

Is it possible for an InitContainer to change the environment variables of the application container when running inside the same Pod?

Note that I am looking for a detailed answer that describes the technical reasons why this is or isn't possible. Example: 'Current container technology supports environment variable isolation between containers and Pods cannot bypass that restriction by "grouping" containers in the same "environment variable space"'.

Bengal

Answer 1

Short answer is No, they can't.

You can try some hack something using ShareProcessNamespace and gdb but for sure this is not correct solution for problem you are trying to solve.

Albritton

I would appreciate the long answer. – Bengal

longer answer depends on what are you trying to achieve. I can imagine two options (please tell me if it's something else): 1. you are trying to simplify your deployment.yaml file to avoid repeating setting the same vars, 2. you are trying to use env as some form of inter process communication. Just forget about 2: #263505 regarding 1 - There is no syntax sugar for it in standard kubernetes. but you can use some tempting solutions like helm or ksonnet. – Albritton

Maciek long story short we have existing containers that we don't want to change. – Bengal

Hi, is this still not possible? because I have a NodeJS app that is running basically two of itself inside of one pod but grabbing env variables from two different secrets – Ithnan

Answer 2

No, it is not possible to just change the variables like that. One of the possible workarounds is to use an EmptyDir volume shared between the InitContainer and the main container. You can store there a the variables using a file in InitContainer and load them in the main container using a some simple shell script.

Dibromide

Answer 3

That exactly what we do with Vault on kubernetes, using the injector from https://developer.hashicorp.com/vault/docs/platform/k8s/injector/annotations.

This will inject an init container.

Then, we use an emptyDir volume, the vault agent init container will create a file in it, then the running container will source it at start.

Wil