title: Openshift/kubernetes: map serviceaccount secret to an environment variable
body: <p>Is there a way to populate the serviceaccount secrets content to an environment variable?</p>
  
  <p>Example: when a pod is started, it contains a <code>/var/run/secrets/kubernetes.io/secrets/serviceaccount/</code> folder that contains <code>token</code>, <code>ca.crt</code>... and other that is the result to map the <code>serviceaccount</code> sercret to a folder.</p>
  
  <p>Is there anyway to map <code>serviceaccountsecret.token</code> to an environment variable?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I'm deploying kubernetes/openshift objects using fabric8 maven plugin. Nevertheless, I was looking for a way of setting this information up on PodSpec.</p>
  
  <p>So, currently openshift/kubernetes is mapping service account information located into secrets and then it's automatically mapped to filesystem (`/var/run...).</p>
  
  <p>I'm looking for a way to map this "unknown" service account secret to environment variable (I mean, I don't know which is the name of this secret, when I'm creating PodSpec).</p>
  
  <pre><code>$ oc get secrets
  NAME                       TYPE                                  DATA      AGE
  builder-dockercfg-hplx4    kubernetes.io/dockercfg               1         43m
  builder-token-bkd8h        kubernetes.io/service-account-token   4         43m
  builder-token-gpckp        kubernetes.io/service-account-token   4         43m
  default-dockercfg-q2vpx    kubernetes.io/dockercfg               1         43m
  default-token-hpr7l        kubernetes.io/service-account-token   4         43m
  default-token-r5225        kubernetes.io/service-account-token   4         43m
  deployer-dockercfg-6h7nw   kubernetes.io/dockercfg               1         43m
  deployer-token-svmvf       kubernetes.io/service-account-token   4         43m
  deployer-token-tmg9x       kubernetes.io/service-account-token   4         43m
  vault-cert                 kubernetes.io/tls                     2         42m 
  </code></pre>
  
  <p>As you can see, openshiftshift/kubernetes creates secrets regarding with each service account:</p>
  
  <pre><code>$ oc get sa
  NAME       SECRETS   AGE
  builder    2         44m
  default    2         44m
  deployer   2         44m
  </code></pre>
  
  <p>Each secret has a form like:</p>
  
  <pre><code>$ oc describe secret default-token-hpr7l
  Name:         default-token-hpr7l
  Namespace:    ra-sec
  Labels:       &lt;none&gt;
  Annotations:  kubernetes.io/created-by=openshift.io/create-dockercfg-secrets
                kubernetes.io/service-account.name=default
                kubernetes.io/service-account.uid=82ae89d7-898a-11e8-8d35-f28ae3e0478e
  
  Type:  kubernetes.io/service-account-token
  
  Data
  ====
  ca.crt:          1070 bytes
  namespace:       6 bytes
  service-ca.crt:  2186 bytes
  token:           eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJyYS1zZWMiLCJrdWJlcm5ldGVzLmlvL3Nl...
  </code></pre>
  
  <p>Each secret is mapped to filesystem automatically. Nevertheless, I'd like to write into PodSpec:</p>
  
  <pre><code>env:
  - name: KUBERNETES_TOKEN
    valueFrom:
      secretKeyRef:
        name: &lt;unknown service account secret name&gt;
        key: token
  </code></pre>
  
  <p>I hope I've explianed a bit better.</p>