Cloud Run Secret Reference getting mounted as Directory instead of File

[varaisys]

Hello

Need some help with Cloud Run with Secret Manager, we need to mount 2 secrets as volume (file only), following is the yaml from Cloud Run.

        volumeMounts:
        - name: secret-2f1d5ec9-d681-4b0f-8a77-204c5f853330
          readOnly: true
          mountPath: /root/key/mtls/client_auth.p12
        - name: secret-29c1417a-d9fe-4c37-8cb0-562c97f3c827
          readOnly: true
          mountPath: /root/key/firebase/myapp-d2a0f-firebase-adminsdk-irfes-a699971a4d.json
      volumes:
      - name: secret-2f1d5ec9-d681-4b0f-8a77-204c5f853330
        secret:
          secretName: myapp_mtls_key
          items:
          - key: latest
            path: myapp_mtls_key
      - name: secret-29c1417a-d9fe-4c37-8cb0-562c97f3c827
        secret:
          secretName: myapp_firebase_token
          items:
          - key: latest
            path: myapp_firebase_token

mtls secret (p12 file) is getting mounted properly as a file but the firebase secret (json file) is getting mounted as a directory instead.

java.io.FileNotFoundException: /root/key/firebase/myapp-d2a0f-firebase-adminsdk-irfes-a699971a4d.json (Is a directory)
	at java.base/java.io.FileInputStream.open0(Native Method)
	at java.base/java.io.FileInputStream.open(FileInputStream.java:216)
	at java.base/java.io.FileInputStream.<init>(FileInputStream.java:157)
	at java.base/java.io.FileInputStream.<init>(FileInputStream.java:111)
	at com.myapp.gcp.GCPInit.init(GCPInit.java:39)

Based on docker convention, if a file is not found on the host then its mounted as directory, but in this case we do not have control over the host path or file availability, so could it be a bug?

When testing our deployment in docker container with volume mounts everything works fine so we are sure our application is not at fault.

Appreciate any guidance on this issue.

Thanks

[varaisys · Accepted solution]

Here is what was wrong.

container volume specs are interpreted like this :-
- 'mountPath' under spec->image->volumeMounts specifies the 'parent' directory path.
- 'path' under spec->volumes->secret->items is appended to it.

Thus in our case the actual path became like this :-
/root/key/firebase/myapp-d2a0f-firebase-adminsdk-irfes-a699971a4d.json/myapp_firebase_token

Checking Volume mount under Revisions is the way to verify the real mount path as described in product documentation https://cloud.google.com/run/docs/configuring/secrets#viewing

HTH