Mount a custom secret in Edge job pods

November 12, 2026

You can mount a Kubernetes secret in your Edge job pods so that job containers can read files from a directory you choose. For example, you can supply Kerberos credentials for data source connections that use Kerberos authentication.

Prerequisites

• You installed an Edge site.
• You have access to the Kubernetes cluster where your Edge site is installed.
• You have a Kubernetes secret in the namespace of your Edge site that contains the files you want to mount. You are responsible for creating and maintaining this secret.

Steps

1. Define the following values. Replace the names, keys, and paths with your own.
   Copy

   global:
     jobExtraVolumes:
       - name: <volume-name>
         secret:
           secretName: <secret-name>
           items:
             - key: <key-in-secret>
               path: <file-name-in-mount>
     jobExtraVolumeMounts:
       - name: <volume-name>
         mountPath: <mount-path>
         readOnly: true

   Value	Description
   jobExtraVolumes	The volumes to add to Edge job pods. Each volume refers to a Kubernetes secret by name.
   jobExtraVolumeMounts	Where each volume is mounted in the job container. The name of each mount must match the name of a volume in jobExtraVolumes.

2. Apply the change based on your Edge site installation method.

   • Edge CLI: Run the following command. Each --set flag sets one of the values from step 1. If your Edge site uses a custom namespace, add -n <my-namespace>.
     Copy

     edgecli update \
       --set 'global.jobExtraVolumes[0].name=<volume-name>' \
       --set 'global.jobExtraVolumes[0].secret.secretName=<secret-name>' \
       --set 'global.jobExtraVolumes[0].secret.items[0].key=<key-in-secret>' \
       --set 'global.jobExtraVolumes[0].secret.items[0].path=<file-name-in-mount>' \
       --set 'global.jobExtraVolumeMounts[0].name=<volume-name>' \
       --set 'global.jobExtraVolumeMounts[0].mountPath=<mount-path>' \
       --set 'global.jobExtraVolumeMounts[0].readOnly=true'

     Property	Description
     <volume-name>	A name for the volume. Use the same name in jobExtraVolumes and jobExtraVolumeMounts.
     <secret-name>	The name of the Kubernetes secret that you want to mount.
     <key-in-secret>	The key in the secret that contains the file contents.
     <file-name-in-mount>	The name of the file in the mounted directory.
     <mount-path>	The directory in the job container where the volume is mounted.

   • Helm chart: Save the values from step 1 in a file, and then run the following command:
     Copy

     helm upgrade <release> <chart-ref> \
       -n <edge-namespace> \
       --version <current-chart-version> \
       --reuse-values \
       -f <values-file>

     Property	Description
     <release>	The Helm release name of your Edge site.
     <chart-ref>	The Edge site Helm chart, for example collibra-edge-helm-chart/collibra-edge.
     <edge-namespace>	The namespace of your Edge site. The default is collibra-edge.
     <current-chart-version>	The version of the Helm chart that your Edge site currently uses.
     <values-file>	The file that contains the values from step 1, for example krb5-values.yaml.

3. Set edgeSessionManager.extraJavaOptions to point to your mounted files.

Edge job pods mount the secret at the path you specified.

What's next

• Create a new Edge connection.