How to create CloudSQL Proxy credentials as secrets on GKE

you have to add a volume entry under the spec like so:

  volumes:
    - name: cloudsql-instance-credentials
      secret:
        defaultMode: 420
        secretName: cloudsql-instance-credentials

Note: This belongs to the deployment spec not the container spec.

Edit: Further Information can be found here: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-pod-that-has-access-to-the-secret-data-through-a-volume thanks shalvah for pointing that out.

Actually we can mount configmaps or secrets as files in the pod's container runtime. And then in runtime we can use them in whatever case we need. But to do that, we need to properly set up them.

• create secret/configmap
• add a volume for the secret in .spec.volumes in the pod (if you deploy the pod using deployment then add volume in .spec.template.spec.volumes)
• mount the created volume in .spec.container[].volumemount

Ref: official kubernetes doc

There is a sample for your use case:

  - name: cloudsql-proxy
    image: gcr.io/cloudsql-docker/gce-proxy:1.11
    command: ["/cloud_sql_proxy",
              "-instances=<INSTANCE_CONNECTION_NAME>=tcp:3306",
              "-credential_file=/secrets/cloudsql/credentials.json"]
    securityContext:
      runAsUser: 2  # non-root user
      allowPrivilegeEscalation: false
    volumeMounts:
      - name: cloudsql-instance-credentials
        mountPath: /secrets/cloudsql
        readOnly: true
volumes:
- name: cloudsql-instance-credentials
  secret:
    defaultMode: 511
    secretName: cloudsql-instance-credentials

The current answers are good, but I wanted to provide a more complete example. This came verbatim from some of the old google docs from two years ago (which no longer exist). Replace the @@PROECT@@ and @@DBINST@@ with your own values.

The volumes loads a secret, then volumeMounts makes it visible to the postgres-proxy container at /secrets/cloudsql

    spec:
      volumes:
      - name: cloudsql-oauth-credentials
        secret:
          secretName: cloudsql-oauth-credentials
      - name: cloudsql
        emptyDir:
      containers:
      - name: postgres-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.09
        imagePullPolicy: Always
        command: ["/cloud_sql_proxy",
                  "--dir=/cloudsql",
                  "-instances=@@PROJECT@@:us-central1:@@DBINST@@=tcp:5432",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        volumeMounts:
          - name: cloudsql-oauth-credentials
            mountPath: /secrets/cloudsql
            readOnly: true
          - name: cloudsql
            mountPath: /cloudsql