secret
官网地址: https://kubernetes.io/docs/concepts/configuration/secret/
创建
命令行创建
[root@bjcy-200 secret]# kubectl create secret generic mysecret1 --from-literal=username=bob --from-literal=password=123456 secret/mysecret1 created [root@bjcy-200 secret]# kubectl get secret NAME TYPE DATA AGE default-token-24blg kubernetes.io/service-account-token 3 5d1h mysecret1 Opaque 2 8s
从文件中创建
[root@bjcy-200 secret]# echo -n "devops" > password [root@bjcy-200 secret]# kubectl create secret generic mysecret2 --from-file=./password secret/mysecret2 created [root@bjcy-200 secret]# kubectl get secrets NAME TYPE DATA AGE default-token-24blg kubernetes.io/service-account-token 3 5d1h mysecret1 Opaque 2 6m5s mysecret2 Opaque 1 8s
从文件读取变量创建
[root@bjcy-200 secret]# cat env.txt password=devops [root@bjcy-200 secret]# kubectl create secret generic mysecret3 --from-env-file=./env.txt secret/mysecret3 created [root@bjcy-200 secret]# kubectl get secrets NAME TYPE DATA AGE default-token-24blg kubernetes.io/service-account-token 3 5d1h mysecret1 Opaque 2 7m55s mysecret2 Opaque 1 118s mysecret3 Opaque 1 5s
yaml文件创建
yaml方式创建需要使用 base64 进行编码.
[root@bjcy-200 secret]# echo -n "devops" | base64 # 编码 devops ZGV2b3Bz [root@bjcy-200 secret]# cat secret1.yaml apiVersion: v1 kind: Secret metadata: name: mysecret4 type: Opaque data: password: ZGV2b3Bz [root@bjcy-200 secret]# kubectl apply -f secret1.yaml secret/mysecret4 created [root@bjcy-200 secret]# kubectl get secrets NAME TYPE DATA AGE default-token-24blg kubernetes.io/service-account-token 3 5d1h mysecret1 Opaque 2 11m mysecret2 Opaque 1 5m24s mysecret3 Opaque 1 3m31s mysecret4 Opaque 1 8s
查看
[root@bjcy-200 secret]# kubectl describe secrets mysecret1
Name: mysecret1
Namespace: default
Labels: <none>
Annotations: <none>
Type: Opaque
Data
====
username: 3 bytes
password: 6 bytes
[root@bjcy-200 secret]# kubectl get secrets mysecret1 -o yaml
apiVersion: v1
data:
password: MTIzNDU2
username: Ym9i
kind: Secret
metadata:
creationTimestamp: "2020-09-03T16:30:33Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:password: {}
f:username: {}
f:type: {}
manager: kubectl
operation: Update
time: "2020-09-03T16:30:33Z"
name: mysecret1
namespace: default
resourceVersion: "18499"
selfLink: /api/v1/namespaces/default/secrets/mysecret1
uid: 95540124-c44f-426b-9ec2-844cbf8dfa72
type: Opaque
# base64 解码
[root@bjcy-200 secret]# echo -n "Ym9i" | base64 --decode
bob[root@bjcy-200 secret]#
使用
变量方式
root@env-pod:/# env
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_SERVICE_PORT=443
HOSTNAME=env-pod
PWD=/
PKG_RELEASE=1~buster
HOME=/root
KUBERNETES_PORT_443_TCP=tcp://192.168.0.1:443
SECRET_USERNAME=bob
NJS_VERSION=0.4.2
TERM=xterm
SHLVL=1
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=192.168.0.1
KUBERNETES_SERVICE_HOST=192.168.0.1
KUBERNETES_PORT=tcp://192.168.0.1:443
KUBERNETES_PORT_443_TCP_PORT=443
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NGINX_VERSION=1.19.1
SECRET_PASSWORD=123456
_=/usr/bin/env
root@env-pod:/# echo $SECRET_PASSWORD
123456
root@env-pod:/# echo $SECRET_USERNAME
bob
root@env-pod:/# exit
exit
[root@bjcy-200 secret]# cat env-pod1.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: env-pod
name: env-pod
spec:
containers:
- image: harbor.tcc.com/public/nginx
name: env-pod
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret1
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret1
key: password
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[root@bjcy-200 secret]# kubectl apply -f env-pod1.yaml
pod/env-pod created
[root@bjcy-200 secret]# kubectl get pods
NAME READY STATUS RESTARTS AGE
busyboxxx 1/1 Running 2 5d1h
env-pod 1/1 Running 0 5s
[root@bjcy-200 secret]# kubectl exec -it env-pod bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
root@env-pod:/#
挂载卷方式
[root@bjcy-200 secret]# cat vloume-pod.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: vloume-pod
name: vloume-pod
spec:
volumes:
- name: vloume
secret:
secretName: mysecret1
items:
- key: username
path: my-group/my-username
- key: password
path: my-group/my-password
mode: 0777
containers:
- image: harbor.tcc.com/public/nginx
name: vloume-pod
volumeMounts:
- name: vloume
mountPath: "/vloume"
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[root@bjcy-200 secret]# kubectl apply -f vloume-pod.yaml
pod/vloume-pod created
[root@bjcy-200 secret]# kubectl exec -it vloume-pod sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead.
# ls /vloume/my-group/
my-password my-username
# ls -l /vloume/my-group/
total 8
-rwxrwxrwx 1 root root 6 Sep 3 16:54 my-password
-rw-r--r-- 1 root root 3 Sep 3 16:54 my-username
# exit
[root@bjcy-200 secret]# cat vloume-pod.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: vloume-pod
name: vloume-pod
spec:
volumes:
- name: vloume
secret:
secretName: mysecret1
containers:
- image: harbor.tcc.com/public/nginx
name: vloume-pod
volumeMounts:
- name: vloume
mountPath: "/vloume"
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
mysql示例
[root@bjcy-200 secret]# cat mysql.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: mysql
name: mysql
spec:
containers:
- image: harbor.tcc.com/public/mysql
name: mysql
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret1
key: password
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[root@bjcy-200 secret]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
busyboxxx 1/1 Running 2 5d2h 10.244.235.199 bjcy-182.host.io <none> <none>
env-pod 1/1 Running 0 13m 10.244.235.201 bjcy-182.host.io <none> <none>
mysql 1/1 Running 0 4m35s 10.244.235.202 bjcy-182.host.io <none> <none>
[root@bjcy-200 secret]# mysql -h 10.244.235.202 -uroot -p123456
Welcome to the MariaDB monitor. Commands end with ; or g.
Your MySQL connection id is 3
Server version: 5.7.18 MySQL Community Server (GPL)
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.
MySQL [(none)]> exit
Bye
configmap
官网地址: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/
configmap 配置 和secret类似
创建
[root@bjcy-200 secret]# kubectl create configmap cm1 --from-literal=password=devops
configmap/cm1 created
[root@bjcy-200 secret]# cat cm-envpod.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: cm-pod
name: cm-pod
spec:
containers:
- image: harbor.tcc.com/public/nginx
name: cm-pod
env:
- name: SECRET_USERNAME
valueFrom:
configMapKeyRef:
name: mysecret1
key: username
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[root@bjcy-200 secret]# cat cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: cm2
namespace: default
data:
password: data1
查看
[root@bjcy-200 secret]# kubectl describe configmaps cm2
Name: cm2
Namespace: default
Labels: <none>
Annotations:
Data
====
password:
----
data1
Events: <none>
[root@bjcy-200 secret]# kubectl get configmaps cm2 -o yaml
apiVersion: v1
data:
password: data1
kind: ConfigMap
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","data":{"password":"data1"},"kind":"ConfigMap","metadata":{"annotations":{},"name":"cm2","namespace":"default"}}
creationTimestamp: "2020-09-03T17:29:25Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:password: {}
f:metadata:
f:annotations:
.: {}
f:kubectl.kubernetes.io/last-applied-configuration: {}
manager: kubectl
operation: Update
time: "2020-09-03T17:29:25Z"
name: cm2
namespace: default
resourceVersion: "29597"
selfLink: /api/v1/namespaces/default/configmaps/cm2
uid: 0097fb1d-25ac-4add-a702-8bdc939e9556
使用
[root@bjcy-200 secret]# cat cm-envpod.yaml
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: cm-pod
name: cm-pod
spec:
containers:
- image: harbor.tcc.com/public/nginx
name: cm-pod
env:
- name: SECRET_USERNAME
valueFrom:
configMapKeyRef:
name: mysecret1
key: username
resources: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
status: {}
[root@bjcy-200 secret]# cat cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: cm2
namespace: default
data:
password: data1